Merge pull request #939 from 2thewes/cryptnetcache

Add wow64 systemprofile to CertUtil.tkape
EricZimmerman · Jun 12, 2024 · a85aa31 · a85aa31
2 parents a23cb9e + 195a6e6
commit a85aa31
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/Targets/Windows/CertUtil.tkape b/Targets/Windows/CertUtil.tkape
@@ -1,6 +1,6 @@
 Description: Certutil
-Author: NVISO (@NVISOsecurity)
-Version: 1.0
+Author: NVISO (@NVISOsecurity), 2thewes
+Version: 1.1
 Id: ec903d15-64b5-4484-8786-94b2ad90bfb7
 RecreateDirectories: true
 Targets:
@@ -9,6 +9,11 @@ Targets:
         Category: FileKnowledge
         Path: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\
         Recursive: true
+    -
+        Name: System WOW64 CryptnetUrlCache
+        Category: FileKnowledge
+        Path: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\
+        Recursive: true
     -
         Name: User CryptnetUrlCache
         Category: FileKnowledge