NO AGENT, NO PROBLEM: DISCOVERING REMOTE EDR

Summary from the TLDR InfoSec newsletter

The Performance Logs and Alerts DLL holds various DCOM interfaces that allow someone to interact remotely with Event Tracing for Windows (ETW) providers, trace sessions, configurations, etc. This post demonstrates how these capabilities can be used to detect various attacks without an agent and suggests ways that an attacker can use them to maintain stealthy persistence.