Rule Info
Name
Suspicious DotNET CLR Usage Log Artifact
Author
frack113, omkar72, oscd.community, Wojciech Lesicki
Description
Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.
Reference
Date
2022-11-18 00:00:00
Modified
2023-02-23 00:00:00
Id
e0b06658-7d1d-4cd3-bf15-03467507ff7c
Tags
attack.defense_evasion attack.t1218 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
github-actions[bot]
chore: promote older rules status from `experimental` to `test` (#4651)
2024-01-01
frack113
Update rules/windows/file/file_event/file_event_win_net_cli_artefact.yml
2022-11-18
Scan your endpoints, forensic images or collected files with our portable scanner THOR