# Anti-Virus artifacts.
---
name: Bit9LocalCache
doc: Bit9 local cache database.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_allusersappdata%%\Bit9\Parity Agent\cache.*']
    separator: '\'
supported_os: [Windows]
---
name: CrowdstrikeQuarantine
doc: Crowdstrike stores quarantined files encoded on disk.
sources:
- type: FILE
  attributes:
    paths:
    - '/Library/CS/Quarantine/*'
    - '/Library/Application Support/Crowdstrike/Falcon/Quarantine/*'
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\drivers\CrowdStrike\Quarantine\*']
    separator: '\'
  supported_os: [Windows]
supported_os: [Darwin, Windows]
---
# TODO: rename to CrowdstrikeAgentIdentifier and make CrowdstrikeAgentID and alias
name: CrowdstrikeAgentID
doc: Identifier of a CrowdStrike agent.
sources:
- type: FILE
  supported_os: [Darwin]
  attributes:
    paths: ['/Library/CS/registry.base']
- type: COMMAND
  supported_os: [Linux]
  attributes:
    cmd: '/opt/CrowdStrike/falconctl'
    args: ['-g', '--cid', '--aid']
- type: REGISTRY_VALUE
  supported_os: [Windows]
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CSAgent\Sim', value: 'AG'}]
supported_os: [Darwin, Linux, Windows]
---
name: EsetAVQuarantine
doc: Eset Anti-Virus Quarantine (Infected) files.
sources:
- type: FILE
  attributes: {paths: ['/Library/Application Support/ESET/esets/cache/quarantine/*']}
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths: ['%%environ_allusersappdata%%\ESET\ESET NOD32 Antivirus\Logs\**']
    separator: '\'
  supported_os: [Windows]
supported_os: [Darwin, Windows]
---
name: MicrosoftAVQuarantine
doc: Microsoft Anti-Virus Quarantine (Infected) files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_allusersappdata%%\Microsoft\Microsoft Antimalware\Quarantine\**'
    - '%%environ_allusersappdata%%\Microsoft\Windows Defender\Quarantine\**'
    separator: '\'
supported_os: [Windows]
---
name: MicrosoftAVLogs
doc: Microsoft Anti-Virus log files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_allusersappdata%%\Microsoft\Windows AntiMalware\Support\MPDetection-*.log'
    - '%%environ_allusersappdata%%\Microsoft\Windows AntiMalware\Support\MPLog-*.log'
    - '%%environ_allusersappdata%%\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\**'
    - '%%environ_allusersappdata%%\Microsoft\Windows Defender\Support\MPDetection-*.log'
    - '%%environ_allusersappdata%%\Microsoft\Windows Defender\Support\MPLog-*.log'
    - '%%environ_systemroot%%\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log'
    - '%%environ_systemroot%%\Temp\MpCmdRun.log'
    - '%%users.temp%%\MpCmdRun.log'
    separator: '\'
supported_os: [Windows]
---
name: WindowsDefenderScanDetectionHistoryFiles
doc: Microsoft Windows Defender scan detection history files.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_allusersappdata%%\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\*\*-*-*-*']
    separator: '\'
supported_os: [Windows]
---
name: WindowsDefenderExclusions
doc: |
  Directories, processes and extensions configured not to be scanned by Windows Defender.
  The can be set locally or through group policy objects (GPO).

  Certain malware families (for example, Tofsee) are known to add directories to the
  Paths list in order to avoid being detected by Windows Defender. Other malware
  (for example, REvil) use the existing exclusions to be ignored by Anti-Virus products.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Paths\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Processes\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\Extensions\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Exclusions\TemporaryPaths\*'
    - 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Exclusions\Paths\*'
    - 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Exclusions\Processes\*'
    - 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Exclusions\Extensions\*'
    - 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Exclusions\TemporaryPaths\*'
supported_os: [Windows]
urls:
- 'https://blog.malwarebytes.com/detections/pum-optional-msexclusion/'
- 'https://answers.microsoft.com/en-us/protect/forum/all/windows-defender-how-to-remove-exclusions/2a0cc465-97b2-46ea-ae77-b87075ed124e'
- 'https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html'
- 'https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/'
---
name: SantaLogs
doc: Local Santa logs.
sources:
- type: FILE
  attributes:
    paths:
    - '/var/db/santa/*'
    - '/private/var/db/santa/*'
supported_os: [Darwin]
---
name: SophosAVLogs
doc: Sophos Anti-Virus log files.
sources:
- type: FILE
  attributes: {paths: ['/Library/Logs/Sophos*.log']}
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths: ['%%environ_allusersappdata%%\Sophos\Sophos Anti-Virus\Logs\*']
    separator: '\'
  supported_os: [Windows]
supported_os: [Darwin, Windows]
---
name: SophosAVQuarantine
doc: Sophos Anti-Virus Quarantine (Infected) files.
sources:
- type: FILE
  attributes: {paths: ['/Users/Shared/Infected/*']}
  supported_os: [Darwin]
- type: FILE
  attributes:
    paths: ['%%environ_allusersappdata%%\Sophos\Sophos Anti-Virus\INFECTED\*']
    separator: '\'
  supported_os: [Windows]
supported_os: [Darwin, Windows]
---
name: SymantecAVLogs
doc: Symantec Anti-Virus Log Files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_allusersappdata%%\Symantec\Symantec Endpoint Protection\*\Data\Logs\*.log'
    - '%%environ_allusersappdata%%\Symantec\Symantec Endpoint Protection\*\Data\Logs\AV\*.log'
    - '%%environ_allusersappdata%%\Symantec\Symantec Endpoint Protection\Logs\AV\*.log'
    - '%%users.localappdata%%\Symantec\Symantec Endpoint Protection\Logs\*.log'
    separator: '\'
  supported_os: [Windows]
supported_os: [Windows]
---
name: SymantecAVQuarantine
doc: Symantec Anti-Virus quarantine (infected) and cloud submission files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_allusersappdata%%\Symantec\Symantec Endpoint Protection\**5\*.vbn'
    - '%%environ_allusersappdata%%\Symantec\Symantec Endpoint Protection\Quarantine\**'
    - '%%environ_allusersappdata%%\Symantec\Symantec Endpoint Protection\*\Data\Quarantine\**'
    - '%%environ_allusersappdata%%\Symantec\Symantec Endpoint Protection\*\Data\CmnClnt\ccSubSDK\**'
    separator: '\'
  supported_os: [Windows]
supported_os: [Windows]
