KERNEL_AUDIT_API_SETCONTEXTTHREAD not logs for syswow64 process .

[DefenderLab]

I am using "Microsoft-Windows-Kernel-Audit-API-Calls to monitor usage of "SetThreadContext" API. It is working fine for 64 bit process. But when I use 32 bit process which call SetThreadContext() API. The events does not generated by ETW provider. I have tested on widows 10 64 bit and Windows 11 64 bit OS.

Can someone help me to solve this issue?

[swannman]

Hi @DefenderLab, we're able to assist with issues where the event is being generated by the ETW provider but not being properly captured by krabsetw. If the event is not being generated by the ETW provider in the first place, then that isn't something we can help with.