t1654-log-enumeration

name	T1654_log-enumeration
description	Adversaries may enumerate system and service logs to find useful data.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1654","discovery","esxi","iaas","linux","macos","windows"]
technique_id	T1654
tactic	discovery
all_tactics	["discovery"]
platforms	["ESXi","IaaS","Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1654
tech_stack	["esxi","cloud","linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1654 Log Enumeration

High-Level Description

Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records (Account Discovery), security or vulnerable software (Software Discovery), or hosts within a compromised network (Remote System Discovery).

Host binaries may be leveraged to collect system logs. Examples include using wevtutil.exe or PowerShell on Windows to access and/or export security event information. In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s CollectGuestLogs.exe to collect security logs from cloud hosted infrastructure.

Adversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis.

In addition to gaining a better understanding of the environment, adversaries may also monitor logs in real time to track incident response procedures. This may allow them to adjust their techniques in order to maintain persistence or evade defenses.

Kill Chain Phase

• Discovery (TA0007)

Platforms: ESXi, IaaS, Linux, macOS, Windows

What to Check

• Identify if Log Enumeration technique is applicable to target environment
• Check ESXi systems for indicators of Log Enumeration
• Check IaaS systems for indicators of Log Enumeration
• Check Linux systems for indicators of Log Enumeration
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Get-EventLog To Enumerate Windows Security Log

Uses the built-in PowerShell commandlet Get-EventLog to search for 'SYSTEM' keyword and saves results to a text file.

This technique was observed in a TheDFIRReport case where the threat actor enumerated the Windows Security audit log to determine user accounts and associated IPv4 addresses.