Potential shellcode execution via ETW logger thread

Adversaries may employ the undocumented EtwpCreateEtwThread function to execute shellcode within the local process address space.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1055

Back to all rules