Jonathan Johnson

Research & Tradecraft

Understanding Telemetry: Kernel Callbacks

Introduction I’ve published blogs around telemetry mechanisms like Event Tracing for Windows (ETW) in the Uncovering Windows Events series, but…

Research & Tradecraft

Exploring Impersonation through the Named Pipe Filesystem Driver

Introduction Impersonation happens often natively in Windows, however, adversaries also use it to run code in the context of another…

Uncovering Windows Events

Threat Intelligence ETW Not all manifest-based Event Tracing for Windows (ETW) providers that are exposed through Windows are ingested into…

Telemetry Layering

Introduction Creating detections can be challenging. There often isn’t a “simple” way to detect something, and once we see an…

The Defender’s Guide to Windows Services

It’s dangerous to find malicious services alone! Take this! Authors: Luke Paine & Jonathan Johnson Introduction This is the second installment of…

Uncovering Window Security Events

Part 1: TelemetrySource Data is the foundation by which defense is built upon. This data can come from various telemetry…

WMI Internals Part 3

Beyond COM In a previous blog post of mine — WMI Internals Part 2: Reversing a WMI Provider I walked through how…