{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1654","id":"T1654","name":"Log Enumeration","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1654","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"dcff84c94e6dbaaa18ba6d68a4fd1231d2c0656ac9a8ef2def132b2ffaa4e363","description":"Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)).\n\nHost binaries may be leveraged to collect system logs. Examples include using `wevtutil.exe` or [PowerShell](https://attack.mitre.org/techniques/T1059/001) on Windows to access and/or export security event information.(Citation: WithSecure Lazarus-NoPineapple Threat Intel Report 2023)(Citation: Cadet Blizzard emerges as novel threat actor) In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s `CollectGuestLogs.exe` to collect security logs from cloud hosted infrastructure.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console)\n\nAdversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis.\n\nIn addition to gaining a better understanding of the environment, adversaries may also monitor logs in real time to track incident response procedures. This may allow them to adjust their techniques in order to maintain persistence or evade defenses.(Citation: Permiso GUI-Vil 2023)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1654","external_id":"T1654"},{"source_name":"Permiso GUI-Vil 2023","description":"Ian Ahl. (2023, May 22). Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor. Retrieved August 30, 2024.","url":"https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor/"},{"source_name":"SIM Swapping and Abuse of the Microsoft Azure Serial Console","description":"Mandiant Intelligence. (2023, May 16). SIM Swapping and Abuse of the Microsoft Azure Serial Console: Serial Is Part of a Well Balanced Attack. Retrieved June 2, 2023.","url":"https://www.mandiant.com/resources/blog/sim-swapping-abuse-azure-serial"},{"source_name":"Cadet Blizzard emerges as novel threat actor","description":"Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source_name":"WithSecure Lazarus-NoPineapple Threat Intel Report 2023","description":"Ruohonen, S. & Robinson, S. (2023, February 2). No Pineapple! -DPRK Targeting of Medical Research and Technology Sector. Retrieved July 10, 2023.","url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf"}],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1654","id":"T1654","name":"Log Enumeration","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1654","technique_page":"techniques/enterprise/T1654/","page":"detections/enterprise/T1654/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0255","name":"Detection Strategy for Log Enumeration","url":"https://attack.mitre.org/detectionstrategies/DET0255","stix_id":"x-mitre-detection-strategy--170a958d-79a6-433a-8ab0-c8d654e2ca86","relationship_id":"relationship--d47d41b9-233e-405c-99ef-e7b5592dabb3","description":"","analytics":[{"id":"AN0705","name":"Analytic 0705","guidance":"Monitor for use of native utilities such as wevtutil.exe or PowerShell cmdlets (Get-WinEvent, Get-EventLog) to enumerate or export logs. Unusual access to security or system event channels, especially by non-administrative users or processes, should be correlated with subsequent file export or network transfer activity.","url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0705","platforms":["Windows"],"tuning":[{"field":"WhitelistedAdminTools","description":"Expected log management scripts executed by administrators should be excluded from alerts."},{"field":"TimeWindow","description":"Correlate enumeration attempts with file export or network transfer within a defined timeframe."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0705","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0705","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","platforms":["Windows"],"analytic_id":"AN0705","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0705","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN0706","name":"Analytic 0706","guidance":"Monitor for suspicious use of commands such as cat, less, grep, or journalctl accessing /var/log/ files. Abnormal enumeration of authentication logs (auth.log, secure) or bulk access to multiple logs in short time windows should be flagged.","url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0706","platforms":["Linux"],"tuning":[{"field":"AdminMaintenanceScripts","description":"Filter routine scripts used for log rotation or troubleshooting."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"execve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)","platforms":["Linux"],"analytic_id":"AN0706","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0706","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0055","component":"File Access","name":"auditd:PATH","channel":"open: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)","platforms":["Linux"],"analytic_id":"AN0706","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0706","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN0707","name":"Analytic 0707","guidance":"Detect abnormal access to unified logs via log show or fs_usage targeting system log files. Monitor for execution of shell utilities (cat, grep) against /var/log/system.log and for plist modifications enabling verbose logging.","url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0707","platforms":["macOS"],"tuning":[{"field":"DebugToolsContext","description":"Allowlist developers or administrators expected to review logs during debugging."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"Execution of log show, fs_usage, or cat targeting system.log","platforms":["macOS"],"analytic_id":"AN0707","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0707","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0055","component":"File Access","name":"macos:unifiedlog","channel":"open: Access to /var/log/system.log or related security event logs","platforms":["macOS"],"analytic_id":"AN0707","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0707","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN0708","name":"Analytic 0708","guidance":"Monitor for cloud API calls that export or collect guest or system logs. Abnormal use of Azure VM Agent’s CollectGuestLogs.exe or AWS CloudWatch GetLogEvents across multiple instances should be correlated with lateral movement or data staging.","url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0708","platforms":["IaaS"],"tuning":[{"field":"LogExportThreshold","description":"Define thresholds for volume/frequency of log export requests considered suspicious."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"AWS:CloudTrail","channel":"GetLogEvents: High frequency log exports from CloudWatch or equivalent services","platforms":["IaaS"],"analytic_id":"AN0708","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0708","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0055","component":"File Access","name":"azure:activity","channel":"CollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows","platforms":["IaaS"],"analytic_id":"AN0708","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0708","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN0709","name":"Analytic 0709","guidance":"Monitor ESXi shell or API access to host logs under /var/log/. Abnormal enumeration of vmkernel.log, hostd.log, or vpxa.log by unauthorized accounts should be flagged.","url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0709","platforms":["ESXi"],"tuning":[{"field":"AdminSessions","description":"Correlate with legitimate administrator access sessions to reduce noise."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"Execution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.log","platforms":["ESXi"],"analytic_id":"AN0709","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0709","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0055","component":"File Access","name":"esxi:hostd","channel":"read: Access to sensitive log files by non-admin users","platforms":["ESXi"],"analytic_id":"AN0709","source_url":"https://attack.mitre.org/detectionstrategies/DET0255#AN0709","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S1091","name":"Pacu","url":"https://attack.mitre.org/software/S1091","kind":"tool","description":"[Pacu](https://attack.mitre.org/software/S1091) can collect CloudTrail event histories and CloudWatch logs.(Citation: GitHub Pacu)","relationship_id":"relationship--7a938acf-f072-42ba-8b5f-16e78ebea7f7","references":[{"source_name":"GitHub Pacu","description":"Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.","url":"https://github.com/RhinoSecurityLabs/pacu"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) can identify infected system log information.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--f2a5153d-95fa-41b3-8d5f-d99d2b0b1aa4","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1191","name":"Megazord","url":"https://attack.mitre.org/software/S1191","kind":"malware","description":"[Megazord](https://attack.mitre.org/software/S1191) has the ability to print the trace, debug, error, info, and warning logs.(Citation: Palo Alto Howling Scorpius DEC 2024)","relationship_id":"relationship--9a3ce7a9-f3b9-4387-bd7e-a1cf1b8c8f67","references":[{"source_name":"Palo Alto Howling Scorpius DEC 2024","description":"Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}]},{"id":"S1194","name":"Akira _v2","url":"https://attack.mitre.org/software/S1194","kind":"malware","description":"[Akira _v2](https://attack.mitre.org/software/S1194) can enumerate the trace, debug, error, info, and warning logs on targeted systems.(Citation: Cisco Akira Ransomware OCT 2024)(Citation: Palo Alto Howling Scorpius DEC 2024)","relationship_id":"relationship--9c0b8bff-6cfe-4b12-843c-19985efd2d3b","references":[{"source_name":"Cisco Akira Ransomware OCT 2024","description":"Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"},{"source_name":"Palo Alto Howling Scorpius DEC 2024","description":"Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}]},{"id":"S1246","name":"BeaverTail","url":"https://attack.mitre.org/software/S1246","kind":"malware","description":"[BeaverTail](https://attack.mitre.org/software/S1246) has identified .ldb and .log files stored in browser extension directories for collection and exfiltration.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)","relationship_id":"relationship--2d3409c6-fbfd-486a-90ee-dc71e48a36d2","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}]}],"actors":[{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has used [Wevtutil](https://attack.mitre.org/software/S0645) to gather Windows Security Event Logs.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023)","relationship_id":"relationship--a53771f3-24ed-4799-a1e8-8cf747cbfe4d","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","description":"Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"id":"G0143","name":"Aquatic Panda","url":"https://attack.mitre.org/groups/G0143","kind":"intrusion-set","description":"[Aquatic Panda](https://attack.mitre.org/groups/G0143) enumerated logs related to authentication in Linux environments prior to deleting selective entries for defense evasion purposes.(Citation: Crowdstrike HuntReport 2022)","relationship_id":"relationship--72c13b6e-3134-4b0f-a51b-123db35ae080","references":[{"source_name":"Crowdstrike HuntReport 2022","description":"CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) has enumerated SECURITY and SYSTEM log files during intrusions.(Citation: CISA GRU29155 2024)","relationship_id":"relationship--36ac187b-e0a4-4603-8c83-49d71f88df7b","references":[{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used `wevtutil.exe` and the PowerShell command `Get-EventLog security` to enumerate Windows logs to search for successful logons.(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--6848a6be-5571-4e88-b95d-45d9a11d4758","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","description":"NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"id":"G1023","name":"APT5","url":"https://attack.mitre.org/groups/G1023","kind":"intrusion-set","description":"[APT5](https://attack.mitre.org/groups/G1023) has used the BLOODMINE utility to parse and extract information from Pulse Secure Connect logs.(Citation: Mandiant Pulse Secure Update May 2021)","relationship_id":"relationship--35423c2b-7b57-423b-8573-6f6cf2cd22ec","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","description":"Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Limit the ability to access and export sensitive logs to privileged accounts where possible.","relationship_id":"relationship--510fefe4-1f76-4c33-a447-2f85e3dc87e2","references":[]}],"candidates":[{"id":"a9030b20-dd4b-4405-875e-3462c6078fdc","name":"Get-EventLog To Enumerate Windows Security Log","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1654/T1654.yaml","description":"Uses the built-in PowerShell commandlet Get-EventLog to search for 'SYSTEM' keyword and saves results to a text file.\n\nThis technique was observed in a [TheDFIRReport case](https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/) \nwhere the threat actor enumerated the Windows Security audit log to determine user accounts and associated IPv4 addresses.\n\nSuccessful execution will save matching log events to the users temp folder.","inputs":{},"dependencies":[],"source_definition_sha256":"73e76608a781e9366c93930ec7c54e7e6dd7fbd8166f1accf884560f8234b478"},{"id":"fef0ace1-3550-4bf1-a075-9fea55a778dd","name":"Enumerate Windows Security Log via WevtUtil","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1654/T1654.yaml","description":"WevtUtil is a command line tool that can be utilised by adversaries to gather intelligence on a targeted Windows system's logging infrastructure. \n\nBy executing this command, malicious actors can enumerate all available event logs, including both default logs such as Application, Security, and System\nas well as any custom logs created by administrators. \n\nThis information provides valuable insight into the system's logging mechanisms, potentially allowing attackers to identify gaps or weaknesses in the logging configuration","inputs":{},"dependencies":[],"source_definition_sha256":"d98a4955cf1f00eea6ede6ec5d404bfbf9328ddfe9218650b88372187a5211a2"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1087":"/ttp-simulation/techniques/enterprise/T1087/","T1518":"/ttp-simulation/techniques/enterprise/T1518/","T1018":"/ttp-simulation/techniques/enterprise/T1018/","T1059.001":"/ttp-simulation/techniques/enterprise/T1059.001/","T1654":"/ttp-simulation/techniques/enterprise/T1654/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1654","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}