CLR Usage log

[ghost]

REF: https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/

File Locations:

• :\Users<user>\AppData\Local\Microsoft\CLR__(arch)\UsageLogs
• :\Windows<System32|SysWOW6$=4>\config\systemprofile\AppData\Local\Microsoft\CLR__(arch)\UsageLogs

look for filenames with .log ext

Reg mod locations:

• HKCU\SOFTWARE\Microsoft.NETFramework
• HKLM\SOFTWARE\Microsoft.NETFramework

Reg key changes:

NGenAssemblyUsageLog
COMPlus_NGenAssemblyUsageLog

[ceramicskate0]

added
HKCU\SOFTWARE\Microsoft.NETFramework
HKLM\SOFTWARE\Microsoft.NETFramework
and that should cover NGenAssemblyUsageLog
COMPlus_NGenAssemblyUsageLog

file create rules appears to not exclude the directory location but it is not special in config either. But should capture log file creation