Windows Registry ETW Logging Disabled for .NET via Security Event 4657
Alerts when .NET ETW logging is disabled via registry changes (ETWEnabled or COMPlus ETW settings) using Event ID 4657.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
- Published
- 2020-06-05
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule detects changes to registry values that disable ETW logging for .NET Framework/.NET runtime settings, observed through Windows Security Event 4657. Attackers may use this to reduce telemetry availability by turning off or weakening ETW-based monitoring, hindering detection of .NET assembly loading and related activity. It relies on Security auditing events that record registry value modifications, specifically EventID 4657 with targeted registry paths and value names ending with ETWEnabled or set to COMPlus_ETWEnabled/COMPlus_ETWFlags with NewValue of 0.
Reporting behind it
- twitter.comhttps://twitter.com/_xpn_/status/1268712093928378368
- social.msdn.microsoft.comhttps://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr
- github.comhttps://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables
- github.comhttps://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38
- github.comhttps://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39
- github.comhttps://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_
- bunnyinside.comhttps://bunnyinside.com/?term=f71e8cb9c76a
- managed670.rssing.comhttp://managed670.rssing.com/chan-5590147/all_p1.html
- github.comhttps://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code
- i.blackhat.comhttps://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-etw-disabled-for-net-via-complus-or-etwenabled-a4c90ea1
title: Windows Registry ETW Logging Disabled for .NET via Security Event 4657
id: 2587de6e-b551-42d4-9ba4-645173d44222
related:
- id: bf4fc428-dcc3-4bbd-99fe-2422aeee2544
type: similar
- id: a4c90ea1-2634-4ca0-adbb-35eae169b6fc
type: derived
status: test
description: This rule detects changes to registry values that disable ETW logging for .NET Framework/.NET runtime settings, observed through Windows Security Event 4657. Attackers may use this to reduce telemetry availability by turning off or weakening ETW-based monitoring, hindering detection of .NET assembly loading and related activity. It relies on Security auditing events that record registry value modifications, specifically EventID 4657 with targeted registry paths and value names ending with ETWEnabled or set to COMPlus_ETWEnabled/COMPlus_ETWFlags with NewValue of 0.
references:
- https://twitter.com/_xpn_/status/1268712093928378368
- https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr
- https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables
- https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38
- https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39
- https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_
- https://bunnyinside.com/?term=f71e8cb9c76a
- http://managed670.rssing.com/chan-5590147/all_p1.html
- https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code
- https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-06-05
modified: 2022-12-20
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
- attack.t1685
logsource:
product: windows
service: security
detection:
selection_etw_enabled:
EventID: 4657
ObjectName|endswith: \SOFTWARE\Microsoft\.NETFramework
ObjectValueName: ETWEnabled
NewValue: 0
selection_complus:
EventID: 4657
ObjectName|contains: \Environment
ObjectValueName:
- COMPlus_ETWEnabled
- COMPlus_ETWFlags
NewValue: 0
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1