tfMITRE ATT&CK technique

Log Enumeration T1654

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.2
Created: 10 July 2023
Last modified: 15 April 2025
Contributors: Bilal Bahadır Yenici; Menachem Goldstein

Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records (Account Discovery), security or vulnerable software (Software Discovery), or hosts within a compromised network (Remote System Discovery).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 70% of ATT&CK techniques have fewer threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 63% of ATT&CK techniques have fewer tools implementing them.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

tfMITRE ATT&CK technique

Log Enumeration T1654

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.2
Created: 10 July 2023
Last modified: 15 April 2025
Contributors: Bilal Bahadır Yenici; Menachem Goldstein

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 70% of ATT&CK techniques have fewer threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 63% of ATT&CK techniques have fewer tools implementing them.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Log Enumeration MITRE reference T1654

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT5G1023 ↗

Has used the BLOODMINE utility to parse and extract information from Pulse Secure Connect logs.1

created 2024-02-051 referenceaka Mulberry Typhoon

Volt TyphoonG1017 ↗

Has used wevtutil.exe and the PowerShell command Get-EventLog security to enumerate Windows logs to search for successful logons.1 2

created 2023-07-272 referencesaka BRONZE SILHOUETTE

Ember BearG1003 ↗

Has enumerated SECURITY and SYSTEM log files during intrusions.1

created 2022-06-091 referenceaka UNC2589

Aquatic PandaG0143 ↗

Enumerated logs related to authentication in Linux environments prior to deleting selective entries for defense evasion purposes.1

created 2022-01-181 reference

Mustang PandaG0129 ↗

Has used Wevtutil to gather Windows Security Event Logs.1

created 2021-04-121 referenceaka TA416

All 5 groups for this technique

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

File AccessDC0055

WinEventLog:Security

EventCode=4663, 4670, 4656

Field	What you tune
WhitelistedAdminTools	Expected log management scripts executed by administrators should be excluded from alerts.
TimeWindow	Correlate enumeration attempts with file export or network transfer within a defined timeframe.

Field

What you tune

WhitelistedAdminTools

Expected log management scripts executed by administrators should be excluded from alerts.

TimeWindow

Correlate enumeration attempts with file export or network transfer within a defined timeframe.

Data component	Name	Channel
File AccessDC0055	auditd:PATH	open: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)
Command ExecutionDC0064	auditd:SYSCALL	execve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)

Field	What you tune
AdminMaintenanceScripts	Filter routine scripts used for log rotation or troubleshooting.

Data component	Name	Channel
File AccessDC0055	macos:unifiedlog	open: Access to /var/log/system.log or related security event logs
Command ExecutionDC0064	macos:unifiedlog	Execution of log show, fs_usage, or cat targeting system.log

Field	What you tune
DebugToolsContext	Allowlist developers or administrators expected to review logs during debugging.

Data component	Name	Channel
File AccessDC0055	azure:activity	CollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows
Command ExecutionDC0064	AWS:CloudTrail	GetLogEvents: High frequency log exports from CloudWatch or equivalent services

Field	What you tune
LogExportThreshold	Define thresholds for volume/frequency of log export requests considered suspicious.

Data component	Name	Channel
File AccessDC0055	esxi:hostd	read: Access to sensitive log files by non-admin users
Command ExecutionDC0064	esxi:shell	Execution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.log

Field	What you tune
AdminSessions	Correlate with legitimate administrator access sessions to reduce noise.

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Get-EventLog To Enumerate Windows Security Log	windows	powershell	Required	—	Yes
Uses the built-in PowerShell commandlet Get-EventLog to search for 'SYSTEM' keyword and saves results to a text file. This technique was observed in a TheDFIRReport case where the threat actor enumerated the Windows Security audit log to determine user accounts and associated IPv4 addresses. Successful execution will save matching log events to the users temp folder. Attack Commandsrun with `powershell`elevation required (root or admin) powershell -c {get-eventlog 'Security' \| where {$_.Message -like 'SYSTEM'} \| export-csv $env:temp\T1654_events.txt} Cleanup Commands powershell -c "remove-item $env:temp\T1654_events.txt -ErrorAction Ignore" GUIDa9030b20-dd4b-4405-875e-3462c6078fdc
02	Enumerate Windows Security Log via WevtUtil	windows	command_prompt	—	—	—
WevtUtil is a command line tool that can be utilised by adversaries to gather intelligence on a targeted Windows system's logging infrastructure. By executing this command, malicious actors can enumerate all available event logs, including both default logs such as Application, Security, and System as well as any custom logs created by administrators. This information provides valuable insight into the system's logging mechanisms, potentially allowing attackers to identify gaps or weaknesses in the logging configuration Attack Commandsrun with `command_prompt` wevtutil enum-logs GUIDfef0ace1-3550-4bf1-a075-9fea55a778dd

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Get-EventLog To Enumerate Windows Security Log

windows

powershell

Required

—

Yes

Enumerate Windows Security Log via WevtUtil

windows

command_prompt

—

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk		The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise. (...)	Generic	stable	-	-	Splunk	Discovery Log Enumeration	CVE-2024-29945	medium	Rod Soto, Chase Franklin	2024-03-27	2026-06-24	9a67e749-d291-40dd-8376-d422e7ecf8b5
Splunk		This analytic detects EventLog reconnaissance activity using utilities such as `wevtutil.exe`, `wmic.exe`, PowerShell cmdlets like `Get-WinEvent`, or WMI queries targeting `Win32_NTLogEvent`. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Log Enumeration	-	medium	Nasreddine Bencherchali, Splunk	2025-04-24	2026-05-13	dc167f8b-3f9d-4460-9c98-8b6e703fd628

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk		The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise. (...)	Generic	stable	-	-	Splunk	Discovery Log Enumeration	CVE-2024-29945	medium	Rod Soto, Chase Franklin	2024-03-27	2026-06-24	9a67e749-d291-40dd-8376-d422e7ecf8b5
Splunk		This analytic detects EventLog reconnaissance activity using utilities such as `wevtutil.exe`, `wmic.exe`, PowerShell cmdlets like `Get-WinEvent`, or WMI queries targeting `Win32_NTLogEvent`. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Log Enumeration	-	medium	Nasreddine Bencherchali, Splunk	2025-04-24	2026-05-13	dc167f8b-3f9d-4460-9c98-8b6e703fd628

Log Enumeration T1654

Log Enumeration T1654

Log Enumeration MITRE reference T1654

Log Enumeration MITRE reference T1654

Offense vs defense T1654

Log Enumeration detection strategy DET0255

Detection Strategy for Log Enumeration

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log Enumeration detections T1654

Log Enumeration detections T1654