ETW Logging Disabled For rpcrt4.dll

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

Detects changes to the "ExtErrorInformation" key in the Windows Registry to disable Event Tracing for Windows (ETW) logging specifically for rpcrt4.dll. This modification can be used by adversaries to impair defenses by hiding their activities related to RPC (Remote Procedure Call) communications.