Yuta/Glove Stealer ETW EtwEventWrite In-Memory Patch via Python Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects attempts by processes, such as Python or PyInstaller-compiled binaries, to perform in-memory patching of the 'EtwEventWrite' function within 'ntdll.dll'. This technique is used to bypass Event Tracing for Windows (ETW) and suppress security telemetry, a tactic observed in campaigns like Glove Stealer.