# Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion

DevFeed: [Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion](<https://devfeed.tech/articles/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion-20500.md>)

Original publisher: [Read original article](<https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/>)

Author: bohops

Published: 2021-03-16T04:08:58Z

Content type: article

Language: en

Sources: [Bohops](<https://devfeed.tech/sources/bohops.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Logging](<https://devfeed.tech/topics/logging.md>), [.NET](<https://devfeed.tech/topics/net.md>), [Security](<https://devfeed.tech/topics/security.md>), [Threat Hunting & Intel](<https://devfeed.tech/topics/threat-hunting-intel.md>), [Machine Learning, Security Attacks](<https://devfeed.tech/topics/machine-learning-security-attacks.md>)

Tags: [code](<https://devfeed.tech/tags/code.md>), [endpoint-security](<https://devfeed.tech/tags/endpoint-security.md>), [logging](<https://devfeed.tech/tags/logging.md>), [net](<https://devfeed.tech/tags/net.md>), [process](<https://devfeed.tech/tags/process.md>), [processes](<https://devfeed.tech/tags/processes.md>), [security](<https://devfeed.tech/tags/security.md>), [uncategorized](<https://devfeed.tech/tags/uncategorized.md>)

## AI overview

This article examines how .NET CLR Usage Logs can help defenders detect and investigate .NET execution, including assembly injection into process memory. It describes how the CLR creates Usage Log files and discusses tampering techniques intended to evade endpoint detection, along with monitoring opportunities for identifying that tampering.

## Source excerpt

Introduction In recent years, there have been numerous published techniques for evading endpoint security solutions and sources such as A/V, EDR and logging facilities. The methods deployed to achieve the desired result usually differ in sophistication and implementation, however, effectiveness is usually the end goal (of course, with thoughtful consideration of potential tradeoffs). Defenders can [...]