How do you detect ETW tampering?

Detect ETW tampering by splitting it into system-wide and in-process cases. System-wide, alert on Autologger registry values set to zero, logman or wevtutil commands that stop or disable sessions, and audit policy changes (Event 4719). In-process, where EtwEventWrite is patched, use EDR memory telemetry or Threat-Intelligence ETW to catch the function-prologue change. In both cases, measure the gap: a host that is online but silent in providers it normally fills is the strongest sign that its telemetry has been blinded.

Detecting ETW Tampering: Patching, Provider Disable and Telemetry Gaps

Event Tracing for Windows feeds Sysmon, the .NET runtime, PowerShell, Defender and most EDR sensors. Adversaries tamper with it either inside one process, by patching EtwEventWrite so that process stops emitting events, or system-wide, by stopping sessions and disabling providers. The first is hard to see directly; the second leaves clear configuration changes. Both create a gap you can measure.

Signals at a Glance

Signal	Where	ATT&CK
EtwEventWrite or NtTraceEvent patched to return immediately in a process	EDR memory telemetry, Threat-Intelligence ETW	T1562.006
logman stop or delete on a trace session; wevtutil sl /e:false	Sysmon 1, 4688	T1562.006
Autologger session or provider Enabled value set to 0	Sysmon 13	T1562.006
Audit policy weakened (auditpol /set ... /success:disable)	Security 4719	T1562.002
A host that stops emitting expected providers while still online	SIEM heartbeat	T1562.006

System-Wide Provider Changes

System-wide tampering is configuration change, and configuration change is loggable. Watch the Autologger registry hive, the command-line tools that edit sessions, and the audit policy event. Sigma covers the registry route:

title: ETW Autologger Provider Disabled
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: '\Control\WMI\Autologger\'
    TargetObject|endswith:
      - '\Enabled'
      - '\Start'
    Details: 'DWORD (0x00000000)'
  filter_trusted:
    Image|endswith:
      - '\TrustedInstaller.exe'
      - '\msiexec.exe'
  condition: selection and not filter_trusted
level: high
# tune/validate: patch cycles legitimately rewrite autologger keys.

Pair it with the command-line side. Security tooling is usually the only legitimate caller of logman or wevtutil sl against operational channels:

index=wineventlog OR index=sysmon (EventCode=1 OR EventCode=4688)
  ((Image="*\\logman.exe" CommandLine IN ("*stop*","*delete*","*update*"))
   OR (Image="*\\wevtutil.exe" CommandLine="* sl *" CommandLine IN ("*/e:false*","*/e:fa*"))
   OR (Image="*\\auditpol.exe" CommandLine="*disable*"))
| stats count min(_time) as first max(_time) as last by host, user, Image, CommandLine
| sort - count
`comment("tune/validate: allowlist your configuration-management account")`

Detecting the Gap

In-process patching of EtwEventWrite removes events at the source, so the host never reports them. The defensible answer is to measure what should be there. Every healthy endpoint produces a steady volume of process, image-load and PowerShell events. A host that is online (it still sends Defender heartbeats or network flows) but silent in a provider it normally fills deserves a ticket.

Build a per-host expected-volume baseline for Sysmon Event 1, 7 and 10 and PowerShell 4104, and alert when a host drops below a low percentile for several hours.
Compare host liveness (agent check-in, DHCP, EDR heartbeat) against event volume; liveness without events is the signature of a blinded sensor.
Enable .NET and PowerShell logging redundancy: if script block logging disappears but process creation continues, suspect targeted tampering.
Use EDR self-protection alerts for ntdll integrity; a patched EtwEventWrite is a function-prologue change that integrity checks can compare against disk.

Vetted sources

Use the SigmaHQ registry and command-line rules for ETW and autologger tampering, Elastic’s defense-evasion ETW detections, Splunk ESCU content on logman and wevtutil, and MITRE ATT&CK T1562.006. Atomic Red Team includes ETW disable tests. Baseline your own environment — endpoint agents legitimately create and recycle trace sessions.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

System-Wide Provider Changes

Detecting the Gap

Build Detections That Fire

Defense Evasion Detection

Detection Hub

AMSI Bypass Detection

Event Log Clearing Detection