I'm a defensive specialist and security researcher at FalconForce and specialize in understanding the attacker tradecraft and thereby improving detection.
I'm a Microsoft MVP and have presented at many industry conferences including Black Hat, DEF CON, DerbyCon, Splunk .conf, FIRST, MITRE ATT&CKcon, and various other conferences.
I maintain a blog at olafhartong.nl.
You can also find me on Twitter and LinkedIn.
If you're here for ETW tools, this is what I currently have:
| Description | Link |
|---|---|
| PockETWatcher – Lightweight ETW consumer | https://github.com/olafhartong/PockETWatcher |
| ETWhat – Provider mode enumeration tool | https://github.com/olafhartong/ETWhat |
| ETWLocksmith – Provider security analyzer | https://github.com/olafhartong/ETWLocksmith |
| autologgerAnalyzer – Autologger details | https://github.com/olafhartong/autologgerAnalyzer |
| ETWtop – Session performance monitoring | https://github.com/olafhartong/ETWtop |
| Provmon – ETW provider registration monitor tool | https://github.com/olafhartong/provmon/ |
| BamboozlEDR – ETW event emitting and BOFs | https://github.com/olafhartong/BamboozlEDR |
