Skip to content
Threat Feed
Subscribe

Tag

Etw

5 briefs RSS
medium advisory

Impairment of Windows Event Logging via AutoLogger Registry Manipulation

Adversaries manipulate Windows WMI AutoLogger registry keys to disable logging providers and telemetry, facilitating defense evasion and persistence on compromised systems.

Windows defense-evasion registry etw
1r 1t
high advisory

Detection of ETW Disabling via Registry Modification

Attackers modify registry keys to disable Event Tracing for Windows (ETW), effectively blinding security telemetry and facilitating defense evasion.

Windows defense-evasion registry etw
1r 1t
high advisory

ETW Registry Disabled via Registry Modification

Attackers may disable Event Tracing for Windows (ETW) for the .NET Framework by modifying the ETWEnabled registry value, allowing them to evade endpoint detection and response (EDR) tools and hide malicious activity.

.NETFramework +3 etw registry defense-evasion windows t1127 t1685
2r 1t
high advisory

Detection of ETW Disabling via Registry Modification

Attackers may disable Event Tracing for Windows (ETW) by modifying specific registry keys to evade detection and hinder security monitoring, potentially leading to further system compromise.

.NETFramework +3 defense-evasion registry-modification etw ransomware windows
2r
high advisory

Registry Modification to Disable .NET ETW Logging

Attackers may modify the Windows registry to disable ETW logging for the .NET Framework, hindering endpoint detection and response capabilities.

Splunk Enterprise +2 defense-evasion registry-modification etw
2r 1t