Cyber Risks · Trail of Bits Blog

Real-time file monitoring on Windows with osquery

Summary: Trail of Bits has released ntfs_journal_events, a new event-based osquery table for Windows that reads the NTFS change journal ($Extend\$UsnJrnl) to monitor changes to specific files, directories, and patterns on Windows endpoints. The approach reads records via DeviceIoControl calls (FSCTL_QUERY_USN_JOURNAL and FSCTL_READ_USN_JOURNAL) anchored to Update Sequence Numbers, avoiding the fixed-size buffer and blocking overhead of ReadDirectoryChangesW and kernel-mode minifilters.

What you should know: The change journal's default size is 1MB and its documentation is conspicuously silent on dropped records and wraparound behavior, so a burst of file activity on a busy endpoint could outrun what your monitoring actually captures.

Read the original at Trail of Bits Blog ↗