ETW Provider Disable Targeting AMSI Telemetry and PowerShell Script Block Logging
Detects attempts to tamper with security monitoring mechanisms including AMSI, ETW, and PowerShell Script Block Logging by monitoring process command line arguments for termination or configuration modifications and tracking registry key modifications related to these security features.
CQL
