CmdID

CmdID / PowerShell / Cmdlets / Remove

Remove-EtwTraceProvider

Removes an ETW provider from the ETW or AutoLogger session. Windows Server PowerShell reference

From the Windows Server PowerShell reference 10 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

10 in the Windows Server PowerShell reference
-AsJobRuns the cmdlet as a background job.
-AutologgerNameSpecifies the name of the target AutoLogger session.
-CimSession, -SessionRuns the cmdlet in a remote session or on a remote computer.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-GuidSpecifies the provider ID.
-InputObjectSpecifies the input to this cmdlet.
-PassThruIndicates that this cmdlet returns an object that represents the item on which it operates.
-SessionNameSpecifies the name of the target ETW session.
-ThrottleLimitSpecifies the maximum number of concurrent operations that can be established to run the cmdlet.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name Remove-EtwTraceProvider
highETW Trace Evasion Activity@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community