Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NETCLRUsageLogs-update #885

Merged
merged 2 commits into from
Nov 13, 2023
Merged

NETCLRUsageLogs-update #885

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
339ce1a
Update NETCLRUsageLogs with system-scoped files
Qazeer Nov 13, 2023
1c20ca5
Add NETCLRUsageLogs to CombinedLogs
Qazeer Nov 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 34 additions & 29 deletions Targets/Compound/CombinedLogs.tkape
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,29 +1,34 @@
Description: Collect Event logs, Trace logs, Windows Firewall and PowerShell console
Author: Mike Cary, Mark Hallman added the USBDevicelogs target
Version: 1.1
Id: d4fdd600-15b1-4b78-bc77-88e724861d8d
RecreateDirectories: true
Targets:
-
Name: Windows Event Logs
Category: EventLogs
Path: EventLogs.tkape
-
Name: Event Trace Logs
Category: EventTraceLogs
Path: EventTraceLogs.tkape
-
Name: PowerShell Console Log
Category: PowerShellConsoleLog
Path: PowerShellConsole.tkape
-
Name: Windows Firewall Log
Category: WindowsFirewallLogs
Path: WindowsFirewall.tkape
-
Name: USBDevicesLogs
Category: USB
Path: USBDevicesLogs.tkape

# Documentation
# v1.1 - Added the USBDevicelogs target
Description: Collect Event logs, Trace logs, Windows Firewall, PowerShell console logs, and .NET CLR UsageLogs
Author: Mike Cary, Mark Hallman added the USBDevicelogs target, Thomas DIOT (Qazeer) added the .NET CLR UsageLogs target
Version: 1.2
Id: d4fdd600-15b1-4b78-bc77-88e724861d8d
RecreateDirectories: true
Targets:
-
Name: Windows Event Logs
Category: EventLogs
Path: EventLogs.tkape
-
Name: Event Trace Logs
Category: EventTraceLogs
Path: EventTraceLogs.tkape
-
Name: PowerShell Console Log
Category: PowerShellConsoleLog
Path: PowerShellConsole.tkape
-
Name: Windows Firewall Log
Category: WindowsFirewallLogs
Path: WindowsFirewall.tkape
-
Name: USBDevicesLogs
Category: USB
Path: USBDevicesLogs.tkape
-
Name: .NET CLR UsageLogs
Category: .NET CLR UsageLogs
Path: NETCLRUsageLogs.tkape

# Documentation
# v1.1 - Added the USBDevicelogs target
# v1.2 - Added the .NET CLR UsageLogs target
15 changes: 11 additions & 4 deletions Targets/Windows/NETCLRUsageLogs.tkape
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,21 @@
Description: .NET CLR UsageLogs
Author: Matias Davaro
Version: 1.0
Author: Matias Davaro, Thomas DIOT (Qazeer)
Version: 1.1
Id: f127a2a3-d86f-4ede-96e7-52193db822ad
RecreateDirectories: true
Targets:
-
Name: .NET CLR UsageLogs
Name: .NET CLR UsageLogs (user-scoped)
Category: .NET CLR UsageLogs
Path: C:\Users\%user%\AppData\Local\Microsoft\CLR_*\UsageLogs
Path: C:\Users\%user%\AppData\Local\Microsoft\CLR_*\
Recursive: true
FileMask: '*.log'
-
Name: .NET CLR UsageLogs (system-scoped)
Category: .NET CLR UsageLogs
Path: C:\Windows*\System32\config\systemprofile\AppData\Local\Microsoft\CLR_*\
Recursive: true
FileMask: '*.log'

# Documentation
# https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/
Expand Down