# Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion (Part 2)

DevFeed: [Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion (Part 2)](<https://devfeed.tech/articles/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion-part-2-20505.md>)

Original publisher: [Read original article](<https://bohops.com/2022/08/22/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion-part-2/>)

Author: bohops

Published: 2022-08-22T23:48:27Z

Content type: article

Language: en

Sources: [Bohops](<https://devfeed.tech/sources/bohops.md>)

Topics: [.NET](<https://devfeed.tech/topics/net.md>), [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [SIEM, Security, Observability](<https://devfeed.tech/topics/siem-security-observability.md>)

Tags: [assembly](<https://devfeed.tech/tags/assembly.md>), [code](<https://devfeed.tech/tags/code.md>), [events](<https://devfeed.tech/tags/events.md>), [logs](<https://devfeed.tech/tags/logs.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>), [net](<https://devfeed.tech/tags/net.md>), [powershell](<https://devfeed.tech/tags/powershell.md>), [processes](<https://devfeed.tech/tags/processes.md>), [research](<https://devfeed.tech/tags/research.md>), [uncategorized](<https://devfeed.tech/tags/uncategorized.md>)

## AI overview

This article revisits .NET CLR Usage Logs and examines two additional tampering techniques that can prevent log creation, including discretionary ACL blocking. It also discusses how monitoring Usage Log creation events can help identify suspicious processes that loaded the .NET CLR.

## Source excerpt

Introduction Last year, I blogged about Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion. In that part 1 post, we covered: Recently, I revisited the research topic to close the loop on some outstanding research and figured I would share. In this post, we'll recap .NET Usage Logs, highlight two other tampering techniques, [...]