Potential shellcode execution via ETW logger thread
Adversaries may employ the undocumented EtwpCreateEtwThread function to execute shellcode within the local process address space.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Evasión de defensas
- Técnicas MITRE: T1055