A powerful Windows command-line tool for analyzing and searching ETW (Event Tracing for Windows) provider permissions from the Windows registry.

ETWLocksmith reads ETW provider security permissions from the Windows registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security and provides comprehensive search and analysis capabilities. It can resolve provider names from multiple registry locations and display detailed permission information for each provider.

• 🔍 Search by GUID: Find providers by their GUID with automatic name resolution
• 🔍 Search by Name: Find providers by name (case-insensitive partial matching)
• 🔍 Search by Permission: Find all providers with specific permissions
• 📋 List All Providers: Display all registered ETW providers if they have specific permissions
• 📁 Load from File: Analyze providers from a JSON file
• 📤 Export Data: Export provider data to JSON or CSV formats
• 🔐 Permission Analysis: Detailed breakdown of ETW-specific permissions
• 📝 Name Resolution: Automatic resolution of provider names from multiple registry sources

Note: This tool requires administrative privileges to access the Windows registry. Always run security analysis tools in a controlled environment and review the results carefully.

• Windows operating system
• Go 1.19 or later (for building from source)
• Administrative privileges (for registry access)

.\etwlocksmith.exe list

Displays all registered ETW providers with their GUIDs, names, and security permissions.

.\etwlocksmith.exe search-guid "{751ef305-6c6e-4fed-b847-02ef79d26aef}"

Searches for a specific provider by GUID. Automatically resolves the provider name and shows security permissions.

.\etwlocksmith.exe search-name "Microsoft-Antimalware-Service"

Searches for providers by name using case-insensitive partial matching. Shows both provider names and security permissions.

.\etwlocksmith.exe search-permission "WMIGUID_QUERY"

Finds all providers that have a specific permission. Useful for security analysis and compliance checking.

.\etwlocksmith.exe load-file providers.json

Loads a list of providers from a JSON file and displays their permissions. The file should contain an array of objects with providerGuid and name fields.

Example JSON format:

[
  {
    "providerGuid": "751ef305-6c6e-4fed-b847-02ef79d26aef",
    "name": "Microsoft-Antimalware-Service"
  },
  {
    "providerGuid": "16c6501a-ff2d-46ea-868d-8f96cb0cb52d",
    "name": "Microsoft-Windows-SEC"
  }
]

.\etwlocksmith.exe export json providers_export.json

Exports all provider data to a JSON file with detailed permission information.

.\etwlocksmith.exe export csv providers_export.csv

Exports all provider data to a CSV file for analysis in spreadsheet applications.

.\etwlocksmith.exe permissions

Displays all available ETW permissions with their hexadecimal values and descriptions.

The tool recognizes and displays the following ETW-specific permissions:

ETWLocksmith automatically resolves provider names from multiple registry locations:

1. WBEM Providers (SOFTWARE\Microsoft\WBEM\Providers)
2. WMI Security (SYSTEM\CurrentControlSet\Control\WMI\Security)
3. WMI Registration (SOFTWARE\Microsoft\Windows NT\CurrentVersion\WMI\Security)
4. ETW Autologger (SYSTEM\CurrentControlSet\Control\WMI\Autologger)
5. WINEVT Publishers (SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers)
6. Event Log Providers (Application, System, Security)
7. Well-known Providers (built-in mappings)

The tool distinguishes between two types of providers:

Providers with explicit security permissions registered in the WMI Security registry. These show the actual security descriptor with specific access control entries (ACEs).

Providers found in WINEVT or other registries but without explicit security permissions. These show default ETW permissions that apply to all unregistered providers.

Important Note: For kernel-mode ETW providers, the permissions shown may not be representative of actual access control. Kernel providers require a kernel driver to utilize their permissions, and the effective access control is enforced at the driver level rather than through the user-mode security descriptors displayed by this tool. The permissions shown for kernel providers reflect the user-mode interface permissions but may not indicate the actual kernel-level access capabilities.

• GUID: The provider's unique identifier
• Name: Resolved friendly name (if available)
• Security Permissions Registered: Boolean indicating if explicit permissions are registered
• Permissions: List of access control entries with:
  • Type (Allow/Deny)
  • Account (SID or account name)
  • Access Mask (hexadecimal value)
  • Human-readable permissions

GUID: {751EF305-6C6E-4FED-B847-02EF79D26AEF}
Name: Microsoft-Antimalware-Service
Security Permissions Registered: true
Permissions:
  Allow - SYSTEM (0x00001FFF): TRACELOG_ACCESS_KERNEL_LOGGER, TRACELOG_CREATE_INPROC, TRACELOG_CREATE_ONDISK, TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_JOIN_GROUP, TRACELOG_LOG_EVENT, TRACELOG_REGISTER_GUIDS, WMIGUID_EXECUTE, WMIGUID_NOTIFICATION, WMIGUID_QUERY, WMIGUID_READ_DESCRIPTION, WMIGUID_SET
  Allow - Everyone (0x001204E1): TRACELOG_CREATE_ONDISK, TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT, WMIGUID_QUERY

• Audit ETW provider permissions across systems
• Identify providers with excessive permissions
• Verify compliance with security policies

• Debug ETW tracing issues
• Verify provider registration
• Check permission conflicts

• Generate reports for security audits
• Document ETW provider configurations
• Track permission changes over time

• Understand ETW provider requirements
• Debug custom ETW providers
• Verify provider security settings

• Security Permissions: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security
• Provider Names: Multiple locations including WINEVT, WBEM, and Event Log registries

The tool parses Windows Security Descriptors and Discretionary Access Control Lists (DACLs) to extract:

• Access Control Entries (ACEs)
• Security Identifiers (SIDs)
• Access masks and permissions

For unregistered providers, the tool applies the standard ETW default permissions:

• Everyone: TRACELOG_REGISTER_GUIDS
• SYSTEM, LOCAL SERVICE, NETWORK SERVICE, Administrators: Full access
• Performance Log Users: Extended logging permissions
• Performance Monitor Users: Notification permissions

Huge thanks to Geoff Chappell for his amazing documentation page! (https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/etw/secure/index.htm)