All things Symantec

This post contains information on my research into Symantec logs and quarantine files. Content will be updated regularly.

Symantec Endpoint Protection Logs

Symantec Management Client (smc) does not show the entire contents of the log. smc.exe has an -exportlog commandline switch where you can select a log type to export.  Log_type numbers are as follows:

• 0 = System Log
• 1 = Security Log
• 2 = Traffic Log
• 3 = Packet Log
• 4 = Control Log 

These numbers also correlate to an entry in the header of the logs found in C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs.

• 0 = syslog.log
• 1 = seclog.log
• 2 = tralog.log
• 3 = rawlog.log
• 4 = processlog.log

Log File Structure

• Client Management System Log
• Client Management Security Log
• Network and Host Exploit Mitigation Traffic Log
• Network and Host Exploit Mitigation Packet Log
• Client Management Control Log

Symantec Endpoint Protection VBN Files

Folder structure makes a difference in what is contained in the vbn file. SEP quarantine files are located in C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine. In the quarantine folder, there is a vbn file and a folder with the same name as the vbn file.

• Symantec Endpoint Protection VBN Files
• VBN file format v1 (containing quarantine file)
• VBN file format v2 (containing quarantine file)
• VBN log line information

Remotely grab Symantec logs with Log Parser

Are you adding Symantec Endpoint Protection logs to your investigations? If not, there could be some information you are missing. These logs are located at C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs. Some of the logs contained in the folder path include:

AVMan.log - AV Management plugin log (contains copies of all AV events)

GUProxy.log - GUP plugin log (if you have a GUP enabled)

LUMan.log - SEP Client LiveUpdate plugin log

processlog.log - Application and Device Control log

rawlog.log - Firewall Packet log

seclog.log - Security log (IPS events mainly)

syslog.log - System log

tralog.log - Firewall Traffic log

Using Microsoft's Log Parser and Log Parser Studio, I created a couple of queries to parse these logs. And the best part is, you can query the logs on a remote system. The only thing left for you to do is export the results into your timeline. The library file for Log Parser Studio can be found here.

Enjoy!

AVMan.log

Daily AV Logs:

syslog.log:

USB forensics with Logparser Studio

Pictures are worth a thousand words. Enjoy!!!!

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

HKLM\SYSTEM\CurrentControlSet\Enum\USB

HKLM\SYSTEM\MountedDevices