CmdID

CmdID / PowerShell / Cmdlets / Set

Set-EtwTraceProvider

Modifies a provider's enablement settings in an ETW or AutoLogger session. Windows Server PowerShell reference

From the Windows Server PowerShell reference 14 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

14 in the Windows Server PowerShell reference
-AsJobRuns the cmdlet as a background job.
-AutologgerNameSpecifies the name of the target AutoLogger session.
-CimSession, -SessionRuns the cmdlet in a remote session or on a remote computer.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-GuidSpecifies the provider ID.
-InputObjectSpecifies the input to this cmdlet.
-LevelSpecifies the maximum event level to enable for a collection.
-MatchAllKeywordSpecifies a bitmask of keywords an event must match in order to be logged to the session.
-MatchAnyKeywordSpecifies a bitmask of keywords an event must match in order to be logged to the session.
-PassThruIndicates that this cmdlet returns an object that represents the item on which it operates.
-PropertySpecifies the EnableProperty to use for events logged from this provider to the session.
-SessionNameSpecifies the name of the target ETW session.
-ThrottleLimitSpecifies the maximum number of concurrent operations that can be established to run the cmdlet.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name Set-EtwTraceProvider
highETW Trace Evasion Activity@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community