Techniques › T1654
T1654 Log Enumeration
discovery — ESXi, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1654
0
KEV CVEs mapped here
<p>Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records (Account Discovery), security or vulnerable software (Software Discovery), or hosts within a compromised network (Remote System Discovery).</p><p>Host binaries may be leveraged to collect system logs. Examples include using
wevtutil.exe or PowerShell on Windows to access and/or export security event information. In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s CollectGuestLogs.exe to collect security logs from cloud hosted infrastructure.</p><p>Adversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis.</p><p>In addition to gaining a better understanding of the environment, adversaries may also monitor logs in real time to track incident response procedures. This may allow them to adjust their techniques in order to maintain persistence or evade defenses.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0255 Detection Strategy for Log Enumeration v1.0
AN0705 WindowsMonitor for use of native utilities such as wevtutil.exe or PowerShell cmdlets (Get-WinEvent, Get-EventLog) to enumerate or export logs. Unusual access to security or system event channels, especially by non-administrative users or processes, should be correlated with subsequent file export or network transfer activity.Tunable:
WhitelistedAdminToolsTimeWindowAN0706 LinuxMonitor for suspicious use of commands such as cat, less, grep, or journalctl accessing /var/log/ files. Abnormal enumeration of authentication logs (auth.log, secure) or bulk access to multiple logs in short time windows should be flagged.auditd:SYSCALLexecve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)→ DC0064 Command Executionauditd:PATHopen: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)→ DC0055 File AccessTunable:AdminMaintenanceScriptsAN0707 macOSDetect abnormal access to unified logs via log show or fs_usage targeting system log files. Monitor for execution of shell utilities (cat, grep) against /var/log/system.log and for plist modifications enabling verbose logging.macos:unifiedlogExecution of log show, fs_usage, or cat targeting system.log→ DC0064 Command Executionmacos:unifiedlogopen: Access to /var/log/system.log or related security event logs→ DC0055 File AccessTunable:DebugToolsContextAN0708 IaaSMonitor for cloud API calls that export or collect guest or system logs. Abnormal use of Azure VM Agent’s CollectGuestLogs.exe or AWS CloudWatch GetLogEvents across multiple instances should be correlated with lateral movement or data staging.AWS:CloudTrailGetLogEvents: High frequency log exports from CloudWatch or equivalent services→ DC0064 Command Executionazure:activityCollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows→ DC0055 File AccessTunable:LogExportThresholdAN0709 ESXiMonitor ESXi shell or API access to host logs under /var/log/. Abnormal enumeration of vmkernel.log, hostd.log, or vpxa.log by unauthorized accounts should be flagged.esxi:shellExecution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.log→ DC0064 Command ExecutionTunable:AdminSessions
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1654
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.