PowerShell ETW Trace Disabling Techniques

Adversaries frequently target Windows Event Tracing (ETW) to blind security monitoring solutions. By leveraging PowerShell cmdlets such as Remove-EtwTraceProvider or Set-EtwTraceProvider, attackers can programmatically disable or modify the configuration of tracing providers. Disabling these providers prevents the logging of sensitive activities, including process creation, network connections, and script execution, which are critical for detecting malicious post-exploitation activity. This technique is typically employed during the late stages of an attack chain to facilitate persistence or long-term data exfiltration without triggering security alerts.

Impact

Successful suppression of ETW providers results in significant gaps in security telemetry. Defenders lose visibility into script execution and process-related events on compromised hosts. This degradation of observability allows attackers to operate with a reduced risk of detection, effectively neutralizing host-based detection capabilities that rely on ETW-derived event logs.

Recommendation

1. Deploy the provided Sigma rule to detect attempts to manipulate ETW providers via PowerShell script blocks.
2. Ensure PowerShell Script Block Logging (Event ID 4104) is enabled across the environment to capture the command line content.
3. Review logs for the identified cmdlets and investigate associated processes for unauthorized administrative activity.