Geoff Chappell, Software Analyst
SKETCH OF HOW RESEARCH MIGHT CONTINUE AND RESULTS BE PRESENTED
This function writes a user-mode security event.
ULONG EtwWriteUMSecurityEvent ( PCEVENT_DESCRIPTOR EventDescriptor, USHORT EventProperty, ULONG UserDataCount, PEVENT_DATA_DESCRIPTOR UserData);
The EventProperty argument specifies properties of the event. The supported values are:
For other arguments (and the return value), refer to Microsoft’s documentation of EventWrite.
This function is essentially a call to the kernel, specifically through NtTraceEvent case 0x05. The kernel verifies that the current process is the one that earlier called EtwRegisterSecurityProvider for permission to write security events. For other processes, the function fails (returning ERROR_ACCESS_DENIED).
The EtwWriteUMSecurityEvent function is exported by name from NTDLL.DLL in version 6.0 and higher.
Perhaps unsurprisingly, this function is not documented. Its only known user is LSASRV.DLL.