All Detections

ETW Logging Disabled For rpcrt4.dll

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

Sigma