Techniques › T1654 › AN0707
AN0707 Analytic 0707
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detect abnormal access to unified logs via log show or fs_usage targeting system log files. Monitor for execution of shell utilities (cat, grep) against /var/log/system.log and for plist modifications enabling verbose logging.</p>
- Detects
- T1654 Log Enumeration
- Part of
- DET0255 Detection Strategy for Log Enumeration
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Execution of log show, fs_usage, or cat targeting system.log | DC0064 Command Execution |
| macos:unifiedlog | open: Access to /var/log/system.log or related security event logs | DC0055 File Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
DebugToolsContext | Allowlist developers or administrators expected to review logs during debugging. |