Telemetry-Tampering - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/telemetry-tampering/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 02:42:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of .NET ETW Logging Tampering via Registryhttps://feed.craftedsignal.io/briefs/2026-11-dotnet-etw-tampering/Tue, 10 Nov 2026 02:42:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-dotnet-etw-tampering/Adversaries may modify specific registry keys or environment variables to disable Event Tracing for Windows (ETW) within .NET processes to blind EDR telemetry.Attackers can disable ETW providers for .NET applications by modifying registry keys or setting specific environment variables. This technique allows malicious code, such as loaded .NET assemblies, to execute without being recorded by security products relying on ETW for visibility. This behavior has been documented as a method to impair security monitoring and defense mechanisms.

Impact

Disabled ETW logging in .NET processes prevents security tools from observing method calls, assembly loading, and other runtime events, significantly reducing the efficacy of detection platforms.

Recommendation

  • Deploy the provided Sigma rule to monitor for registry modifications related to .NET ETW configuration.
  • Establish a baseline of legitimate modifications to these specific registry keys (e.g., during software deployment or patching) to reduce false positives.
  • Implement monitoring for changes to system and user environment variables, specifically those starting with "COMPlus_".
]]>highadvisorydefense-impairmentpersistencewindowstelemetry-tampering