Fibratus

Fibratus is a tool for exploration and tracing of the Windows kernel. It lets you trap system-wide events and assert against a rule engine to detect stealthy adversary attacks and sophisticated threats.