TLDR Tech / InfoSec
EtwWatcher (GitHub Repo)
EtwWatcher is a static, browser-side web app for browsing and diffing snapshots of Windows ETW provider state across builds, letting detection engineers and threat hunters see which providers, events, keywords, and template fields shifted between Windows builds (including Patch Tuesday cumulative updates and Insider builds) without spinning up VMs. Snapshots are produced by the companion PowerShell module ETWInspector and committed as NDJSON. Users can also drop in their own .ndjson or .ndjson.gz for full in-browser analysis. Coverage spans Manifest, MOF, and TraceLogging providers — WPP is not yet supported, and MOF event metadata enumeration remains incomplete due to WMI quirks.
Read the full story