Kernel ETW is the best ETW

This article analyzes Windows kernel ETW telemetry—covering legacy vs. modern event/trace providers, their trustworthiness, and how security teams can enumerate and validate kernel-level audit events. It details methods to extract provider metadata (including TraceLogging and WPP), correlate EtwRegister/EtwWrite calls to specific APIs, and reveals limitations such as failure-only logging patterns. The piece introduces a Ghidra-based script that maps ETW event descriptors to kernel functions, providing practical guidance to improve the reliability and coverage of security telemetry for defenders.