etl event trace deletion detector — free browser tool | fatcousin

drop wevtutil · logman · json etw exports · detect deleted or disabled edr providers · runs locally

input

drop wevtutil ep · logman query providers · trace session exports

edr provider disable/delete · autologger stopped · multi-file

Select file

crowdstrike · sentinelone · defender · sysmon · threat intelligence providers · disabled/stopped/deleted status

limits

heuristic screener · parses wevtutil/logman/json exports locally · provider inventory may be incomplete · not definitive proof

status

>ready