Microsoft .NET Framework: ETW logging disablement via registry

Adversaries can suppress ETW logging for .NET applications by setting registry values to zero. This technique interferes with the ability of security tools to record loaded .NET assemblies, effectively blinding EDR or SIEM telemetry that relies on these ETW providers. This involves modifying global configuration keys under the .NETFramework registry hive or setting environment-specific COMPlus variables via the registry.

Impact

Successful exploitation prevents security products from gaining visibility into .NET assembly loading events, which are critical for detecting the execution of fileless malware, reflective DLL injection, and other memory-resident threats.

Recommendation

Deploy detection rules to monitor for unauthorized modifications to the identified registry keys. Audit the environment for systems that have these keys set to zero.

Attack Chain

1. Attacker gains administrative access to the target host.
2. Attacker modifies registry keys to alter .NET runtime behavior.
3. Attacker sets ETWEnabled or COMPlus_ETWEnabled/Flags to 0.
4. Subsequent .NET processes launched inherit these configurations.
5. Security telemetry (ETW) is suppressed for these processes.
6. Attacker proceeds with malicious actions (e.g., loading malicious assemblies) while bypassing detection.