ETW bypass

[Ref].Assembly.GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue($provider,0)

Disables ETW (Event Tracing for Windows) instrumentation in your process so security tools do not receive its events.

Run it right before loading mimikatz or a beacon in memory: many EDRs and Defender itself rely on ETW providers (Microsoft-Windows-Threat-Intelligence, DotNet, PowerShell) to see what your process does. Patching m_enabled to 0 turns off the provider only in your process, without affecting the rest of the system.

If the EDR uses kernel callbacks or minifilters (most modern ones), the ETW bypass does not affect them: they detect via another route. On Windows 11 22H2+ the classic patch fails when the antivirus PPL protection starts earlier; there you need a patchless method like SharpBlock.