ETW Logging Disabled In .NET Processes via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

This rule detects attempts to disable Event Tracing for Windows (ETW) logging within .NET processes by modifying specific registry keys. Adversaries may perform this action to evade detection by security tools that rely on ETW for monitoring .NET activity. The rule specifically looks for modifications to the 'ETWEnabled' and 'ETWFlags' registry keys under 'SOFTWARE\Microsoft\.NETFramework' or 'COMPlus_' prefixed keys, setting their values to '0' (disabled). This indicates an attempt to prevent the recording of loaded .NET assemblies and other relevant ETW events, thereby hindering security monitoring capabilities.