Skip to content

Instantly share code, notes, and snippets.

@CaledoniaProject

CaledoniaProject/EmulateProcExpDotNetEnumeration.ps1

Forked from mattifestation/EmulateProcExpDotNetEnumeration.ps1
Created August 11, 2018 09:42
Show Gist options
  • Save CaledoniaProject/fa87e9e022871ec6b4fbb866764ba8f2 to your computer and use it in GitHub Desktop.
Save CaledoniaProject/fa87e9e022871ec6b4fbb866764ba8f2 to your computer and use it in GitHub Desktop.
Download ZIP
Replicates the data collected when enumerating .NET Assemblies in Process Explorer
Raw
EmulateProcExpDotNetEnumeration.ps1
logman start trace dotNetAssemblyTrace2 -p "Microsoft-Windows-DotNETRuntimeRundown" "LoaderRundownKeyword, StartRundownKeyword" win:Informational -o dotNetAssemblyTrace2.etl -ets
Start-Sleep -Seconds 5
logman stop dotNetAssemblyTrace2 -ets
$EnumeratedCLRRuntimes = Get-WinEvent -Path .\dotNetAssemblyTrace2.etl -Oldest -FilterXPath '*[System[(EventID=187)]]'
$EnumeratedAppDomains = Get-WinEvent -Path .\dotNetAssemblyTrace2.etl -Oldest -FilterXPath '*[System[(EventID=157)]]'
$EnumeratedAssemblies = Get-WinEvent -Path .\dotNetAssemblyTrace2.etl -Oldest -FilterXPath '*[System[(EventID=155)]]'
$EnumeratedModules = Get-WinEvent -Path .\dotNetAssemblyTrace2.etl -Oldest -FilterXPath '*[System[(EventID=153)]]'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment