Detection of .NET Framework ETW Evasion via Registry Modification

This threat involves the deliberate disabling of Event Tracing for Windows (ETW) for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to '0' within the Windows Registry. By targeting the 'Environment' key path in either the current user (HKCU) or machine (HKLM) registry hives, attackers can globally suppress ETW events generated by .NET-based processes. This technique is a potent method for defense evasion, as many security products and EDR agents rely on .NET ETW providers to monitor malicious assembly loading, reflection, and general managed-code execution. Disabling this instrumentation significantly limits the visibility of defenders into post-exploitation activities, allowing attackers to maintain persistence and execute malicious payloads with a reduced risk of detection. This modification is rarely performed for legitimate purposes outside of specific developer debugging scenarios, making it a high-fidelity indicator of adversarial activity.

Attack Chain

1. Attacker gains administrative or user-level persistence on a Windows host.
2. Attacker identifies the target environment for .NET Framework configuration.
3. Attacker accesses the Windows Registry via reg.exe, PowerShell, or native API calls.
4. Attacker modifies the HKLM or HKCU "Environment" key to add or set "COMPlus_ETWEnabled" to "0".
5. Subsequent .NET processes launched on the host fail to initialize ETW providers.
6. Attacker executes malicious .NET-based payloads (e.g., Cobalt Strike beacons, reflective loaders).
7. EDR tools fail to capture telemetry from the .NET runtime due to the suppressed ETW events.
8. Attacker operates in the environment with reduced visibility, achieving long-term stealthy impact.

Impact

Successful exploitation of this technique results in significant blind spots within the security stack. Because .NET is the primary runtime for a wide variety of attacker tools, compromising the visibility of this runtime allows for the execution of fileless malware, credential theft tools, and persistence mechanisms that remain invisible to logs relying on ETW. This can lead to prolonged unauthorized access, data exfiltration, and full system compromise without triggering behavioral or script-block detection rules.

Recommendation

1. Deploy the Sigma rules below to monitor registry key modifications to the 'Environment' path involving the 'COMPlus_ETWEnabled' value.
2. Enable Sysmon Event ID 13 (RegistryEvent) across the enterprise to ensure visibility into registry modification attempts.
3. Investigate any instances where 'COMPlus_ETWEnabled' is set to '0' or '0x00000000', as these are highly suspicious and indicative of defensive evasion.
4. Audit the existing Environment variable keys on critical infrastructure to ensure no unauthorized configurations exist.