Rule Info
Name
Suspicious DotNET CLR Usage Log Artifact
Author
frack113, omkar72, oscd.community, Wojciech Lesicki
Description
Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.
Reference
Date
2022-11-18 00:00:00
Modified
2023-02-23 00:00:00
Id
e0b06658-7d1d-4cd3-bf15-03467507ff7c
Tags
attack.defense-evasion attack.t1218
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
Fukusuke Takahashi
Merge PR #4940 from @fukusuket - Update unreachable references `blog.menasec[.]net`
2024-07-31
github-actions[bot]
chore: promote older rules status from `experimental` to `test` (#4651)
2024-01-01
frack113
Update rules/windows/file/file_event/file_event_win_net_cli_artefact.yml
2022-11-18
Scan your endpoints, forensic images or collected files with our portable scanner THOR