{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/security-visibility/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["evasion","defense-impairment","powershell","windows","security-visibility"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries frequently target Windows Event Tracing (ETW) to blind security monitoring solutions. By leveraging PowerShell cmdlets such as Remove-EtwTraceProvider or Set-EtwTraceProvider, attackers can programmatically disable or modify the configuration of tracing providers. Disabling these providers prevents the logging of sensitive activities, including process creation, network connections, and script execution, which are critical for detecting malicious post-exploitation activity. This technique is typically employed during the late stages of an attack chain to facilitate persistence or long-term data exfiltration without triggering security alerts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful suppression of ETW providers results in significant gaps in security telemetry. Defenders lose visibility into script execution and process-related events on compromised hosts. This degradation of observability allows attackers to operate with a reduced risk of detection, effectively neutralizing host-based detection capabilities that rely on ETW-derived event logs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect attempts to manipulate ETW providers via PowerShell script blocks.\u003c/li\u003e\n\u003cli\u003eEnsure PowerShell Script Block Logging (Event ID 4104) is enabled across the environment to capture the command line content.\u003c/li\u003e\n\u003cli\u003eReview logs for the identified cmdlets and investigate associated processes for unauthorized administrative activity.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T14:33:41Z","date_published":"2026-10-12T14:33:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-etw-evasion-powershell/","summary":"Adversaries utilize PowerShell cmdlets to disable or modify Event Tracing for Windows (ETW) providers to impair security visibility and evade detection.","title":"PowerShell ETW Trace Disabling Techniques","url":"https://feed.craftedsignal.io/briefs/2026-10-etw-evasion-powershell/"}],"language":"en","title":"CraftedSignal Threat Feed - Security-Visibility","version":"https://jsonfeed.org/version/1.1"}