Disable of ETW Trace - Powershell — Detection Rule

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

Read the full analysis on IntelFusions