Detection of .NET ETW Logging Tampering via Registry
Adversaries may modify specific registry keys or environment variables to disable Event Tracing for Windows (ETW) within .NET processes to blind EDR telemetry.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 02:42 UTC
- Detection
- 1 rule
- Source quality
- B2Likely
Attackers can disable ETW providers for .NET applications by modifying registry keys or setting specific environment variables. This technique allows malicious code, such as loaded .NET assemblies, to execute without being recorded by security products relying on ETW for visibility. This behavior has been documented as a method to impair security monitoring and defense mechanisms.
Impact
Disabled ETW logging in .NET processes prevents security tools from observing method calls, assembly loading, and other runtime events, significantly reducing the efficacy of detection platforms.
Recommendation
- Deploy the provided Sigma rule to monitor for registry modifications related to .NET ETW configuration.
- Establish a baseline of legitimate modifications to these specific registry keys (e.g., during software deployment or patching) to reduce false positives.
- Implement monitoring for changes to system and user environment variables, specifically those starting with "COMPlus_".
Immediate actions
Enable Audit Registry logging for the specified keys to support Event ID 4657 generation.
Threat Hunt
Identify endpoints with registry modifications to .NETFramework or environment variables starting with COMPlus_.
Data: Event ID 4657
Detection coverage 1
Detect .NET ETW Logging Tampering
highDetects the disabling of ETW providers for .NET processes via registry modifications to .NETFramework keys or COMPlus environment variables.
Detection queries are available on the platform. Get full rules →