Skip to content
Threat Feed

Tag

Etw

3 briefs RSS
high advisory

ETW Registry Disabled via Registry Modification

Attackers may disable Event Tracing for Windows (ETW) for the .NET Framework by modifying the ETWEnabled registry value, allowing them to evade endpoint detection and response (EDR) tools and hide malicious activity.

.NETFramework +3 etw registry defense-evasion windows t1127 t1685
2r 1t
high advisory

Detection of ETW Disabling via Registry Modification

Attackers may disable Event Tracing for Windows (ETW) by modifying specific registry keys to evade detection and hinder security monitoring, potentially leading to further system compromise.

.NETFramework +3 defense-evasion registry-modification etw ransomware windows
2r
high advisory

Registry Modification to Disable .NET ETW Logging

Attackers may modify the Windows registry to disable ETW logging for the .NET Framework, hindering endpoint detection and response capabilities.

Splunk Enterprise +2 defense-evasion registry-modification etw
2r 1t