Introduction

THM Room: Evading Logging and Monitoring

What?

Evade Event Tracing for Windows (ETW).

Why?

To keep the environment as clean and intact as possible while preventing the logging of session or code.

How?

• Study ETW

• Powershell reflection

• Patching tracing functions

• Group policy takeover

• Abusing log pipeline

• Challenge