NET CLR Binary Execution Usage Log Artifact

Rule Info

Id
e0b06658-7d1d-4cd3-bf15-03467507ff7c
Author
frack113
Name
NET CLR Binary Execution Usage Log Artifact
Tags
attack.defense_evasion DEMO attack.t1218
Date
2022-11-18 00:00:00
Modified
None
Description
Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context
Type
Community Rule

Rule History

Author
Date
Commit
Title
frack113
2022-11-18
Apply suggestions from code review
frack113
2022-11-18
Update rules/windows/file/file_event/file_event_win_net_cli_artefact.yml
frack113
2022-11-18
.NET CLR Usage Log