用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1654-log-enumeration命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | T1654_log-enumeration |
| description | Adversaries may enumerate system and service logs to find useful data. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1654","discovery","esxi","iaas","linux","macos","windows"] |
| technique_id | T1654 |
| tactic | discovery |
| all_tactics | ["discovery"] |
| platforms | ["ESXi","IaaS","Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1654 |
| tech_stack | ["esxi","cloud","linux","macos","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records (Account Discovery), security or vulnerable software (Software Discovery), or hosts within a compromised network (Remote System Discovery).
Host binaries may be leveraged to collect system logs. Examples include using wevtutil.exe or PowerShell on Windows to access and/or export security event information. In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s CollectGuestLogs.exe to collect security logs from cloud hosted infrastructure.
Adversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis.
In addition to gaining a better understanding of the environment, adversaries may also monitor logs in real time to track incident response procedures. This may allow them to adjust their techniques in order to maintain persistence or evade defenses.
Platforms: ESXi, IaaS, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Uses the built-in PowerShell commandlet Get-EventLog to search for 'SYSTEM' keyword and saves results to a text file.
This technique was observed in a TheDFIRReport case where the threat actor enumerated the Windows Security audit log to determine user accounts and associated IPv4 addresses.
Successful execution will save matching log events to the users temp folder.
Supported Platforms: windows Elevation Required: Yes
powershell -c {get-eventlog 'Security' | where {$_.Message -like '*SYSTEM*'} | export-csv $env:temp\T1654_events.txt}
WevtUtil is a command line tool that can be utilised by adversaries to gather intelligence on a targeted Windows system's logging infrastructure.
By executing this command, malicious actors can enumerate all available event logs, including both default logs such as Application, Security, and System as well as any custom logs created by administrators.
This information provides valuable insight into the system's logging mechanisms, potentially allowing attackers to identify gaps or weaknesses in the logging configuration
Supported Platforms: windows
wevtutil enum-logs
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Log Enumeration by examining the target platforms (ESXi, IaaS, Linux).
Assess Existing Defenses: Review whether mitigations for T1654 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Limit the ability to access and export sensitive logs to privileged accounts where possible.
| Finding | Severity | Impact |
|---|---|---|
| Log Enumeration technique applicable | Medium | Discovery |
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |