ETW Logging Disabled In .NET Processes via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•18

This rule detects attempts to disable Event Tracing for Windows (ETW) logging specifically for .NET processes by modifying registry values. Adversaries might do this to impair defensive capabilities and hide their activities, particularly when using .NET-based malware or tools.