Merge pull request #939 from 2thewes/cryptnetcache

Add wow64 systemprofile to CertUtil.tkape
EricZimmerman · Jun 12, 2024 · a85aa31 · a85aa31
2 parents a23cb9e + 195a6e6
commit a85aa31
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/Targets/Windows/CertUtil.tkape b/Targets/Windows/CertUtil.tkape
@@ -1,6 +1,6 @@
 Description: Certutil
-Author: NVISO (@NVISOsecurity)
-Version: 1.0
+Author: NVISO (@NVISOsecurity), 2thewes
+Version: 1.1
 Id: ec903d15-64b5-4484-8786-94b2ad90bfb7
 RecreateDirectories: true
 Targets:
@@ -9,6 +9,11 @@ Targets:
  Category: FileKnowledge
  Path: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\
  Recursive: true
+ -
+ Name: System WOW64 CryptnetUrlCache
+ Category: FileKnowledge
+ Path: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\
+ Recursive: true
  -
  Name: User CryptnetUrlCache
  Category: FileKnowledge