# Doubling Down: Detecting In-Memory Threats with Kernel ETW Call Stacks

DevFeed: [Doubling Down: Detecting In-Memory Threats with Kernel ETW Call Stacks](<https://devfeed.tech/articles/doubling-down-detecting-in-memory-threats-with-kernel-etw-call-stacks-49021.md>)

Original publisher: [Read original article](<https://www.elastic.co/security-labs/threat-command/doubling-down-etw-callstacks>)

Author: John Uhlmann,Samir Bousseaden

Published: 2024-01-09T00:00:00Z

Content type: article

Language: en

Sources: [Elastic Security Labs](<https://devfeed.tech/sources/elastic-security-labs.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [telemetry](<https://devfeed.tech/topics/telemetry.md>), [SIEM, Security](<https://devfeed.tech/topics/siem-security.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>)

Tags: [detection-engineering](<https://devfeed.tech/tags/detection-engineering.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [microsoft-windows](<https://devfeed.tech/tags/microsoft-windows.md>), [security](<https://devfeed.tech/tags/security.md>), [siem](<https://devfeed.tech/tags/siem.md>), [telemetry](<https://devfeed.tech/tags/telemetry.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>), [tracing](<https://devfeed.tech/tags/tracing.md>)

## AI overview

Elastic Security 8.11 adds kernel telemetry and ETW call stack-based detections to improve detection of in-memory threats. The article explains the security visibility provided by Windows ETW, the limitations of user-mode hooking, and the tradeoff between endpoint telemetry completeness and SIEM storage costs.

## Source excerpt

With Elastic Security 8.11, we added further kernel telemetry call stack-based detections to increase efficacy against in-memory threats.