Windows Registry Dotnet ETW Disabled Via Environment Variable

The analytic detects a registry modification that disables the ETW for the .NET Framework. It monitors changes to the COMPlus_ETWEnabled registry value under the "Environment" registry key path for both user (HKCU\Environment) and machine (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment) scopes. Disabling ETW can allow attackers to evade Endpoint Detection and Response (EDR) tools and hide their execution from audit logs, potentially leading to further compromise and persistent access within the environment.