Yuta/Glove Stealer ETW Patching of ntdll!EtwEventWrite by PyInstaller Process
Detects memory patching operations targeting 'ntdll.dll', specifically aiming to disable ETW (Event Tracing for Windows) by modifying 'EtwEventWrite' or 'NtTraceEvent' functions. This activity is filtered to detect processes originating from PyInstaller-compiled binaries, identified by the use of '_MEI' temporary extraction directories or specific process names like 'winupdate.exe', which are commonly associated with malicious use of the PyInstaller framework.
Splunk (SPL)
