what`s wrong with Etw

Disclaimer: as I am aware that the given code examples can be dangerous for Etw-based EDR products - all code was made for least popular version of windows - for arm64

Let's assume that we have some application that wants to hide its activity from trace logs - not necessary evil or malicious, for example just to hide used algos or bit paranoid like crypto-wallet. Lets see how can it achieve this (I have no desire to consider trivial cases like removing records from eventlog)

Semiofficial ways

1. Sure all you readed about COMPlus_ETWEnabled but there is also promising COMPlus_ETWFlags 
2. You can switch off etw tracing for services.exe with registry key TracingDisabled in Software\Microsoft\Windows NT\CurrentVersion\Tracing\SCM\Regular
3. And the same for rpcrt4.dll with registry key ExtErrorInformation in HKLM\Software\Policies\Microsoft\Windows NT\Rpc

Actually there are virtually countless ways to do it. And many perhaps not documented bcs was written in Ms by some poor intern who was kicked out in the cold after another review 10+ years ago. I struggled with temptation to make clickbait caption like "99% of windows dlls can disable etw logs" but it`s close to the truth

Patching

1. Yes, good old IAT hijacking for functions like EtwEventWrite works fine even though they can be easily detected
2. Splicing of Etw functions. Almost same as above
3. Some more sophisticated patching of internal wpp structures. For example you can find Etw handles and zero them. Or zero trace level. Or EventsEnableBits. PoC to find etw handles in rpcrt4.dll

Kernel mode

Who immediately remembered InfinityHook? Btw Ms removed pfn GetCpuClock from WMI_LOGGER_CONTEXT since est. build 18963
There are much more kernel sensors. PoC to find CmpTraceRoutine - and suddenly etw events from registry stop generating. Sure it`s not big problem if your product has some code registered with CmRegisterCallback

Conclusion

Etw is unreasonably complex and fragile technology and can easily be broken in too many places