This permanent WMI event subscription will log any ETW providers removed from the Application event log trace session to the event log.

ApplicationEventLogETWProviderRemovalDetection.ps1

# Define the signature - i.e. __EventFilter
$EventFilterArgs = @{
    EventNamespace = 'ROOT/Microsoft/Windows/EventTracingManagement'
    Name = 'ApplicationEventLogProviderRemovalDetection'
    Query = 'SELECT * FROM __InstanceDeletionEvent WITHIN 5 WHERE TargetInstance ISA "MSFT_EtwTraceProvider" AND TargetInstance.SessionName = "EventLog-Application"'
    QueryLanguage = 'WQL'
}

$InstanceArgs = @{
    Namespace = 'root/subscription'
    Class = '__EventFilter'
    Arguments = $EventFilterArgs
}

$Filter = Set-WmiInstance @InstanceArgs

# Define the event log template and parameters
$Template = @(
    'An ETW provider was removed from the Application event log trace session.',
    'SessionName: %TargetInstance.SessionName%',
    'ETW provider GUID removed: %TargetInstance.Guid%'
)

$NtEventLogArgs = @{
    Name = 'ApplicationEventLogProviderRemovalEvent'
    Category = [UInt16] 0
    EventType = [UInt32] 2 # Warning
    EventID = [UInt32] 8
    SourceName = 'WSH'
    NumberOfInsertionStrings = [UInt32] $Template.Length
    InsertionStringTemplates = $Template
}

$InstanceArgs = @{
    Namespace = 'root/subscription'
    Class = 'NTEventLogEventConsumer'
    Arguments = $NtEventLogArgs
}

$Consumer = Set-WmiInstance @InstanceArgs

$FilterConsumerBingingArgs = @{
    Filter = $Filter
    Consumer = $Consumer
}

$InstanceArgs = @{
    Namespace = 'root/subscription'
    Class = '__FilterToConsumerBinding'
    Arguments = $FilterConsumerBingingArgs
}

# Register the alert
$Binding = Set-WmiInstance @InstanceArgs