ETW Patching Module

ETW Patching Module

Desenables ETW tracing in the process actual:

n
• EtwEventWrite patch — Parchea ntdll!EtwEventWrite for retornar inmediatamente (ret 0).
n
• Provider disable — Desenables providers specifics: Microsoft-Windows-Threat-Intelligence, DotNET-Runtime.
n
• Kernel ETW — Technique to disable kernel-level ETW via NtSetSystemInformation (requires admin).
n
• Selective patching — Only parchea the providers that monitorizan actividad ofensiva, dejando the resto intacto for reducir sospecha.
n
• Restore function — Restaura bytes original to the terminar for does not dejar evidencia of tampering.
n