Collect additional McAfee paths (#124)

(DIS-1224)
fox-it · Feb 1, 2024 · 2173d92 · 2173d92
1 parent 456f540
commit 2173d92
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/acquire/acquire.py b/acquire/acquire.py
@@ -1006,6 +1006,19 @@ class AV(Module):
         ("dir", "sysvol/ProgramData/Mcafee/VirusScan"),
         ("dir", "sysvol/ProgramData/McAfee/Endpoint Security/Logs"),
         ("dir", "sysvol/ProgramData/McAfee/MSC/Logs"),
+        ("dir", "sysvol/ProgramData/McAfee/Agent/AgentEvents"),
+        ("dir", "sysvol/ProgramData/McAfee/Agent/logs"),
+        ("dir", "sysvol/ProgramData/McAfee/datreputation/Logs"),
+        ("dir", "sysvol/ProgramData/Mcafee/Managed/VirusScan/Logs"),
+        ("dir", "sysvol/Documents and Settings/All Users/Application Data/McAfee/Common Framework/AgentEvents"),
+        ("dir", "sysvol/Documents and Settings/All Users/Application Data/McAfee/MCLOGS/SAE"),
+        ("dir", "sysvol/Documents and Settings/All Users/Application Data/McAfee/datreputation/Logs"),
+        ("dir", "sysvol/Documents and Settings/All Users/Application Data/McAfee/Managed/VirusScan/Logs"),
+        ("dir", "sysvol/Program Files (x86)/McAfee/DLP/WCF Service/Log"),
+        ("dir", "sysvol/Program Files (x86)/McAfee/ePolicy Orchestrator/Apache2/Logs"),
+        ("dir", "sysvol/Program Files (x86)/McAfee/ePolicy Orchestrator/DB/Events"),
+        ("dir", "sysvol/Program Files (x86)/McAfee/ePolicy Orchestrator/DB/Events/Debug"),
+        ("dir", "sysvol/Program Files (x86)/McAfee/ePolicy Orchestrator/Server/Logs"),
         # RogueKiller
         ("glob", "sysvol/ProgramData/RogueKiller/logs/AdliceReport_*.json"),
         # SUPERAntiSpyware