ETW based POC to identify direct and indirect syscalls - View it on GitHub