dfirhub

McAfee

Antivirusv1.1

Author: Sam Smoker

description

McAfee Log Files

paths

15 paths
AntivirusMcAfee Desktop Protection Logs XP
C:\Users\All Users\Application Data\McAfee\DesktopProtection\
AntivirusMcAfee Desktop Protection Logs
C:\ProgramData\McAfee\DesktopProtection\
AntivirusMcAfee Endpoint Security Logs
C:\ProgramData\McAfee\Endpoint Security\Logs\
AntivirusMcAfee Endpoint Security Logs
C:\ProgramData\McAfee\Endpoint Security\Logs_Old\
AntivirusMcAfee VirusScan Logs
C:\ProgramData\Mcafee\VirusScan\
AntivirusMcAfee MSC Logs
C:\ProgramData\Mcafee\MSC\Logs
AntivirusMcAfee Agent Events
C:\ProgramData\Mcafee\Agent\AgentEvents
AntivirusMcAfee Agent Logs
C:\ProgramData\Mcafee\Agent\logs
AntivirusMcAfee Data Reputation Logs
C:\ProgramData\Mcafee\datareputation\Logs
AntivirusMcAfee Managed VirusScan
C:\ProgramData\Mcafee\Managed\VirusScan\Logs
AntivirusMcAfee Agent Events XP
C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\AgentEvents
AntivirusMcAfee MC Logs XP
C:\Documents and Settings\All Users\Application Data\McAfee\MCLOGS\SAE
AntivirusMcAfee Data Reputation Logs XP
C:\Documents and Settings\All Users\Application Data\McAfee\datreputation\Logs
AntivirusMcAfee Managed VirusScan Logs XP
C:\Documents and Settings\All Users\Application Data\McAfee\Managed\VirusScan\Logs
AntivirusMcAfee WCF Service Logs
C:\Program Files (x86)\McAfee\DLP\WCF Service\Log
› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: McAfee
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. McAfee Desktop Protection Logs XP
Collect-Artifact -SourcePath "C:\Users\All Users\Application Data\McAfee\DesktopProtection\\*" -FolderName "McAfee_Desktop_Protection_Logs_XP"

# 2. McAfee Desktop Protection Logs
Collect-Artifact -SourcePath "C:\ProgramData\McAfee\DesktopProtection\\*" -FolderName "McAfee_Desktop_Protection_Logs"

# 3. McAfee Endpoint Security Logs
Collect-Artifact -SourcePath "C:\ProgramData\McAfee\Endpoint Security\Logs\\*" -FolderName "McAfee_Endpoint_Security_Logs"

# 4. McAfee Endpoint Security Logs
Collect-Artifact -SourcePath "C:\ProgramData\McAfee\Endpoint Security\Logs_Old\\*" -FolderName "McAfee_Endpoint_Security_Logs"

# 5. McAfee VirusScan Logs
Collect-Artifact -SourcePath "C:\ProgramData\Mcafee\VirusScan\\*" -FolderName "McAfee_VirusScan_Logs"

# 6. McAfee MSC Logs
Collect-Artifact -SourcePath "C:\ProgramData\Mcafee\MSC\Logs\*" -FolderName "McAfee_MSC_Logs"

# 7. McAfee Agent Events
Collect-Artifact -SourcePath "C:\ProgramData\Mcafee\Agent\AgentEvents\*" -FolderName "McAfee_Agent_Events"

# 8. McAfee Agent Logs
Collect-Artifact -SourcePath "C:\ProgramData\Mcafee\Agent\logs\*" -FolderName "McAfee_Agent_Logs"

# 9. McAfee Data Reputation Logs
Collect-Artifact -SourcePath "C:\ProgramData\Mcafee\datareputation\Logs\*" -FolderName "McAfee_Data_Reputation_Logs"

# 10. McAfee Managed VirusScan
Collect-Artifact -SourcePath "C:\ProgramData\Mcafee\Managed\VirusScan\Logs\*" -FolderName "McAfee_Managed_VirusScan"

# 11. McAfee Agent Events XP
Collect-Artifact -SourcePath "C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\AgentEvents\*" -FolderName "McAfee_Agent_Events_XP"

# 12. McAfee MC Logs XP
Collect-Artifact -SourcePath "C:\Documents and Settings\All Users\Application Data\McAfee\MCLOGS\SAE\*" -FolderName "McAfee_MC_Logs_XP"

# 13. McAfee Data Reputation Logs XP
Collect-Artifact -SourcePath "C:\Documents and Settings\All Users\Application Data\McAfee\datreputation\Logs\*" -FolderName "McAfee_Data_Reputation_Logs_XP"

# 14. McAfee Managed VirusScan Logs XP
Collect-Artifact -SourcePath "C:\Documents and Settings\All Users\Application Data\McAfee\Managed\VirusScan\Logs\*" -FolderName "McAfee_Managed_VirusScan_Logs_XP"

# 15. McAfee WCF Service Logs
Collect-Artifact -SourcePath "C:\Program Files (x86)\McAfee\DLP\WCF Service\Log\*" -FolderName "McAfee_WCF_Service_Logs"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

included in collections

SANS_Triage Antivirus KapeTriage