ETW-PATCHDefense Evasion

ETW Event-Tracing Patch

Patch EtwEventWrite / NtTraceEvent in process memory — telemetry blinded without admin.

§ Where this technique fits

ETW-PATCH is catalogued under the Defense Evasion tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

AMSI patch → in-memory .NET / PowerShell stager
Patch AmsiScanBuffer in amsi.dll → return clean for any content. Subsequent PowerShell / Office VBA / .NET runtime calls emit attacker code without scanning.
step 3 / 6

§ What commonly comes next

01
Module Stomping
INJ-MODULE-STOMP · Defense Evasion
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

AMSI patch → in-memory .NET / PowerShell stager

§ What commonly comes next