ETW Logging Disabled In .NET Processes - Registry — Detection Rule

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read the full analysis on IntelFusions