ETW

ETW is the high-speed logging framework built into Windows that streams detailed telemetry about processes, network activity, and system internals. Endpoint detection and response products rely on ETW providers to see what is happening on a machine. That makes it a target: malware attempts to patch or unregister ETW to blind security tools, so tampering with ETW is itself a strong indicator of compromise.