ClosedQuorum-style ETW unhook tied to same-process LLM C2 beacon

Arnold Chan@slaz

•updated Sep 23, 2026•0•0•4

Detects the ClosedQuorum 'unhook' evasion technique where a process patches ntdll's EtwEventWrite to suppress ETW telemetry, occurring within a 5-minute window of the same process initiating outbound network connections to known LLM C2 provider APIs or Discord webhooks used for AI-arbitrated decision cycles.