ETW Tampering via NtTraceEvent Modification
Detects potential Event Tracing for Windows tampering through suspicious access to ntdll.dll memory regions, a technique used by Qilin ransomware to suppress telemetry
YARA-L
Detects potential Event Tracing for Windows tampering through suspicious access to ntdll.dll memory regions, a technique used by Qilin ransomware to suppress telemetry
Already have an account?