Tag
Adversaries may modify specific registry keys or environment variables to disable Event Tracing for Windows (ETW) within .NET processes to blind EDR telemetry.