Cross-source coverage
T1654 / ATT&CK
Log Enumeration
5 rules across 3 sources.
From MITRE ATT&CK 19.2
Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records (Account Discovery), security or vulnerable software (Software Discovery), or hosts within a compromised network (Remote System Discovery).
Host binaries may be leveraged to collect system logs. Examples include using wevtutil.exe or PowerShell on Windows to access and/or export security event information. In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s CollectGuestLogs.exe to collect security logs from cloud hosted infrastructure.
Adversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis.
In addition to gaining a better understanding of the environment, adversaries may also monitor logs in real time to track incident response procedures. This may allow them to adjust their techniques in order to maintain persistence or evade defenses.
- Tactics
- Discovery
- Platforms
- ESXi · IaaS · Linux · macOS · Windows
- Telemetry
-
WinEventLog:Securityauditd:SYSCALLauditd:PATHmacos:unifiedlogAWS:CloudTrailazure:activityesxi:shellesxi:hostd
How MITRE says to detect it DET0255
Detection Strategy for Log Enumeration
Windows Analytic 0705
Monitor for use of native utilities such as wevtutil.exe or PowerShell cmdlets (Get-WinEvent, Get-EventLog) to enumerate or export logs. Unusual access to security or system event channels, especially by non-administrative users or processes, should be correlated with subsequent file export or network transfer activity.
WinEventLog:SecurityEventCode=4688WinEventLog:SecurityEventCode=4663, 4670, 4656
Linux Analytic 0706
Monitor for suspicious use of commands such as cat, less, grep, or journalctl accessing /var/log/ files. Abnormal enumeration of authentication logs (auth.log, secure) or bulk access to multiple logs in short time windows should be flagged.
auditd:SYSCALLexecve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)auditd:PATHopen: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)
macOS Analytic 0707
Detect abnormal access to unified logs via log show or fs_usage targeting system log files. Monitor for execution of shell utilities (cat, grep) against /var/log/system.log and for plist modifications enabling verbose logging.
macos:unifiedlogExecution of log show, fs_usage, or cat targeting system.logmacos:unifiedlogopen: Access to /var/log/system.log or related security event logs
IaaS Analytic 0708
Monitor for cloud API calls that export or collect guest or system logs. Abnormal use of Azure VM Agent’s CollectGuestLogs.exe or AWS CloudWatch GetLogEvents across multiple instances should be correlated with lateral movement or data staging.
AWS:CloudTrailGetLogEvents: High frequency log exports from CloudWatch or equivalent servicesazure:activityCollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows
ESXi Analytic 0709
Monitor ESXi shell or API access to host logs under /var/log/. Abnormal enumeration of vmkernel.log, hostd.log, or vpxa.log by unauthorized accounts should be flagged.
esxi:shellExecution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.logesxi:hostdread: Access to sensitive log files by non-admin users
socfortress/Wazuh-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · PowerShell Get-EventLog Enumeration (T1654) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Wevtutil Log Enumeration (T1654) | High | Wazuh XML |
splunk/security_content
2 rules| Detection | Severity | Format |
|---|---|---|
| Splunk Authentication Token Exposure in Debug Log | Undefined | SPL |
| Windows EventLog Recon Activity Using Log Query Utilities | Undefined | SPL |
panther-labs/panther-analysis
1 rule| Detection | Severity | Format |
|---|---|---|
| ZIA Logs Downloaded | Medium | Panther Python |