In-memory ntdll.dll ETW patch (EtwEventWrite/EtwEventWriteFull) evasion

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•3

Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.