DFIRHub

SCCMClientLogs

SCCM Client Log Files

  • Windows
  • 1 path
  • Version 1
  • Andrew Rathbun

Paths on disk

1 path

Notes

Previous version of this Target: https://github.com/EricZimmerman/KapeFiles/commit/2199b6b7749b2f066e9f54a16626160279ab7948

I have seen reference to malicious binaries associated with a user in a log found in this folder

Sample log entry:

<![LOG[Add RecentlyUsedApp: <evil.exe DOMAIN\username>]LOG]!><time="12:22:13.679+300" date="02-27-2022" component="AssetAdvisor" context="" type="1" thread="5564" file="aa_recentlyusedapps.cpp:235">

References

1 link