ETW Registry Disabled for .NET Framework

The analytic detects a registry modification that disables Event Tracing for Windows (ETW) for the .NET Framework. This is achieved by setting the 'ETWEnabled' registry value to '0x00000000' under the '.NETFramework' path. Disabling ETW can be used by attackers to evade Endpoint Detection and Response (EDR) tools and hide their activities from audit logs, potentially leading to undetected compromise and persistent access.