tfMITRE ATT&CK technique

Log Enumeration T1654

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.2
Created: 10 July 2023
Last modified: 15 April 2025
Contributors: Bilal Bahadır Yenici; Menachem Goldstein

Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records (Account Discovery), security or vulnerable software (Software Discovery), or hosts within a compromised network (Remote System Discovery).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Log Enumeration MITRE reference T1654

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT5G1023 ↗

Has used the BLOODMINE utility to parse and extract information from Pulse Secure Connect logs.1

created 2024-02-051 referenceaka Mulberry Typhoon

Volt TyphoonG1017 ↗

Has used wevtutil.exe and the PowerShell command Get-EventLog security to enumerate Windows logs to search for successful logons.1 2

created 2023-07-272 referencesaka BRONZE SILHOUETTE

Ember BearG1003 ↗

Has enumerated SECURITY and SYSTEM log files during intrusions.1

created 2022-06-091 referenceaka UNC2589

Aquatic PandaG0143 ↗

Enumerated logs related to authentication in Linux environments prior to deleting selective entries for defense evasion purposes.1

created 2022-01-181 reference

Mustang PandaG0129 ↗

Has used Wevtutil to gather Windows Security Event Logs.1

created 2021-04-121 referenceaka TA416

All 5 groups for this technique

Offense vs defense T1654

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 2

first rule: 2024 Q1

Log Enumeration detection strategy DET0255

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Log Enumeration

Enterprise

5 platforms

AN0705 · Windows

Monitor for use of native utilities such as wevtutil.exe or PowerShell cmdlets (Get-WinEvent, Get-EventLog) to enumerate or export logs. Unusual access to security or system event channels, especially by non-administrative users or processes, should be correlated with subsequent file export or network transfer activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WhitelistedAdminTools	Expected log management scripts executed by administrators should be excluded from alerts.
TimeWindow	Correlate enumeration attempts with file export or network transfer within a defined timeframe.

AN0706 · Linux

Monitor for suspicious use of commands such as cat, less, grep, or journalctl accessing /var/log/ files. Abnormal enumeration of authentication logs (auth.log, secure) or bulk access to multiple logs in short time windows should be flagged.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	auditd:PATH	open: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)
Command ExecutionDC0064	auditd:SYSCALL	execve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AdminMaintenanceScripts	Filter routine scripts used for log rotation or troubleshooting.

AN0707 · macOS

Detect abnormal access to unified logs via log show or fs_usage targeting system log files. Monitor for execution of shell utilities (cat, grep) against /var/log/system.log and for plist modifications enabling verbose logging.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	macos:unifiedlog	open: Access to /var/log/system.log or related security event logs
Command ExecutionDC0064	macos:unifiedlog	Execution of log show, fs_usage, or cat targeting system.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DebugToolsContext	Allowlist developers or administrators expected to review logs during debugging.

AN0708 · IaaS

Monitor for cloud API calls that export or collect guest or system logs. Abnormal use of Azure VM Agent’s CollectGuestLogs.exe or AWS CloudWatch GetLogEvents across multiple instances should be correlated with lateral movement or data staging.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	azure:activity	CollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows
Command ExecutionDC0064	AWS:CloudTrail	GetLogEvents: High frequency log exports from CloudWatch or equivalent services

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LogExportThreshold	Define thresholds for volume/frequency of log export requests considered suspicious.

AN0709 · ESXi

Monitor ESXi shell or API access to host logs under /var/log/. Abnormal enumeration of vmkernel.log, hostd.log, or vpxa.log by unauthorized accounts should be flagged.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	esxi:hostd	read: Access to sensitive log files by non-admin users
Command ExecutionDC0064	esxi:shell	Execution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AdminSessions	Correlate with legitimate administrator access sessions to reduce noise.

Tests2ExecutorsPowerShell 1 · cmd 1Need elevation1 of 2Have prerequisites0Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Get-EventLog To Enumerate Windows Security Log	windows	PowerShell	Required	—	Yes
Uses the built-in PowerShell commandlet Get-EventLog to search for 'SYSTEM' keyword and saves results to a text file. This technique was observed in a TheDFIRReport case where the threat actor enumerated the Windows Security audit log to determine user accounts and associated IPv4 addresses. Successful execution will save matching log events to the users temp folder. Attack command powershell -c {get-eventlog 'Security' \| where {$_.Message -like 'SYSTEM'} \| export-csv $env:temp\T1654_events.txt} Cleanup command powershell -c "remove-item $env:temp\T1654_events.txt -ErrorAction Ignore" GUIDc830ab5d-9ee9-4f27-8f48-de0c7fae5a97
02	Enumerate Windows Security Log via WevtUtil	windows	cmd	—	—	—
WevtUtil is a command line tool that can be utilised by adversaries to gather intelligence on a targeted Windows system's logging infrastructure. By executing this command, malicious actors can enumerate all available event logs, including both default logs such as Application, Security, and System as well as any custom logs created by administrators. This information provides valuable insight into the system's logging mechanisms, potentially allowing attackers to identify gaps or weaknesses in the logging configuration Attack command wevtutil enum-logs GUID7f8efc0b-666c-4ddd-bd30-f18f131edd31

Tests from Atomic Red Team (MIT licence) · technique definition

Log Enumeration detections T1654

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs