ETW & AMSI

Usermode

Usermode monitoring components using Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) for additional visibility.

Overview

While the kernel driver provides comprehensive system monitoring, ETW and AMSI offer additional usermode visibility that complements kernel-level detection.

ETW

Subscribe to Windows ETW providers for events like .NET assembly loading, PowerShell execution, and more.

AMSI

Receive script content from AMSI-integrated applications like PowerShell, VBScript, and JScript.

ETW Providers

Provider	Events
Microsoft-Windows-PowerShell	Script block logging, command execution
Microsoft-Windows-DotNETRuntime	Assembly loading, JIT compilation
Microsoft-Windows-Kernel-Process	Process start/stop (usermode view)

Features

ETW Consumer

Event Tracing for Windows consumer for usermode events

AMSI Provider

Antimalware Scan Interface provider for script scanning

Usage

Start the DioIPS application
ETW consumer starts automatically
View ETW events in the ETW tab
AMSI events appear when scripts are executed