Skip to content

Instantly share code, notes, and snippets.

@mattifestation

mattifestation/EmulateProcExpDotNetEnumeration.ps1

Created July 26, 2018 18:50
Show Gist options
  • Save mattifestation/4c9583c5e5d0f9f8103d7ded3b82fda9 to your computer and use it in GitHub Desktop.
Save mattifestation/4c9583c5e5d0f9f8103d7ded3b82fda9 to your computer and use it in GitHub Desktop.
Download ZIP
Replicates the data collected when enumerating .NET Assemblies in Process Explorer
Raw
EmulateProcExpDotNetEnumeration.ps1
logman start trace dotNetAssemblyTrace2 -p "Microsoft-Windows-DotNETRuntimeRundown" "LoaderRundownKeyword, StartRundownKeyword" win:Informational -o dotNetAssemblyTrace2.etl -ets
Start-Sleep -Seconds 5
logman stop dotNetAssemblyTrace2 -ets
$EnumeratedCLRRuntimes = Get-WinEvent -Path .\dotNetAssemblyTrace2.etl -Oldest -FilterXPath '*[System[(EventID=187)]]'
$EnumeratedAppDomains = Get-WinEvent -Path .\dotNetAssemblyTrace2.etl -Oldest -FilterXPath '*[System[(EventID=157)]]'
$EnumeratedAssemblies = Get-WinEvent -Path .\dotNetAssemblyTrace2.etl -Oldest -FilterXPath '*[System[(EventID=155)]]'
$EnumeratedModules = Get-WinEvent -Path .\dotNetAssemblyTrace2.etl -Oldest -FilterXPath '*[System[(EventID=153)]]'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment