{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/telemetry-tampering/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["defense-impairment","persistence","windows","telemetry-tampering"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAttackers can disable ETW providers for .NET applications by modifying registry keys or setting specific environment variables. This technique allows malicious code, such as loaded .NET assemblies, to execute without being recorded by security products relying on ETW for visibility. This behavior has been documented as a method to impair security monitoring and defense mechanisms.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eDisabled ETW logging in .NET processes prevents security tools from observing method calls, assembly loading, and other runtime events, significantly reducing the efficacy of detection platforms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for registry modifications related to .NET ETW configuration.\u003c/li\u003e\n\u003cli\u003eEstablish a baseline of legitimate modifications to these specific registry keys (e.g., during software deployment or patching) to reduce false positives.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for changes to system and user environment variables, specifically those starting with \u0026quot;COMPlus_\u0026quot;.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T02:42:12Z","date_published":"2026-11-10T02:42:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-dotnet-etw-tampering/","summary":"Adversaries may modify specific registry keys or environment variables to disable Event Tracing for Windows (ETW) within .NET processes to blind EDR telemetry.","title":"Detection of .NET ETW Logging Tampering via Registry","url":"https://feed.craftedsignal.io/briefs/2026-11-dotnet-etw-tampering/"}],"language":"en","title":"CraftedSignal Threat Feed - Telemetry-Tampering","version":"https://jsonfeed.org/version/1.1"}