SilverFox ETW Disable: NtTraceEvent Patched with RET Byte in ntdll.dll

Ethan Andrews@eandrews

•updated Jun 22, 2026•1•0•6

Detects memory writes to ntdll.dll's NtTraceEvent function patched with a single RET (0xc3) byte, disabling ETW-based tracing across the host — a precision anti-forensics technique used by the SilverFox loader chain.