Windows Internals: Check Your Privilege - The Curious Case of ETW’s SecurityTrace Flag

This blog post is from the original post I made on the Origin (by Prelude) blog. The original can be found here. Introduction Recently, while investigating new feature development for our Origin (by Prelude) Runtime Memory Protection research preview product, we were forced to dig into the inner-workings of Event Tracing for Windows (ETW). In the course of leveraging our internal ETW tooling, which executes at a signing and protection level of Antimalware Protected Process Light (PPL), we notice...