Enum EtwTamperingIndicator 

pub enum EtwTamperingIndicator {
    HighEventsLost {
        session_name: String,
        events_lost: u32,
        threshold: u32,
    },
    MissingEventLogSession {
        expected_name: String,
    },
    SessionStopped {
        session_name: String,
    },
    ZeroBuffers {
        session_name: String,
    },
    SuspiciousLogMode {
        session_name: String,
        log_mode: u32,
    },
}

ETW-level tampering indicators.

Variants

HighEventsLost

Session has abnormally high events_lost count.

Fields

session_name: String

events_lost: u32

threshold: u32

MissingEventLogSession

Expected Event Log session missing (e.g., “EventLog-Security” not found).

Fields

expected_name: String

SessionStopped

Session exists but is not running (stopped ETW session = blind spot).

Fields

session_name: String

ZeroBuffers

Buffer count is zero for a running session (buffers deallocated).

Fields

session_name: String

SuspiciousLogMode

Session has log_mode = 0 (no output configured).

Fields

session_name: String

log_mode: u32

Trait Implementations

impl Clone for EtwTamperingIndicator

fn clone(&self) -> EtwTamperingIndicator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EtwTamperingIndicator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for EtwTamperingIndicator

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.