T1654 — Log Enumeration

Tactic: Discovery · Platforms: ESXi, IaaS, Linux, macOS, Windows

Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records (Account Discovery), security or vulnerable software (Software Discovery), or hosts within a compromised network…

Sigma detection rules (5)

T1654 Log Enumeration

title: T1654 Log Enumeration
id: a536b595-c263-48c8-a137-17bd6ea43bfb
description: 'Detects use of wevtutil.exe or PowerShell Get-WinEvent/Get-EventLog cmdlets to query or export Windows event logs, the actual Log Enumeration behavior (the previous version matched schtasks.exe /query, which is Scheduled Task discovery, not log enumeration). Tune using: WhitelistedAdminTools, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1654
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.discovery
  - attack.t1654

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_wevtutil:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - 'qe '
      - 'query-events'
      - 'gli '
      - 'get-loginfo'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WinEvent'
      - 'Get-EventLog'

  condition: 1 of selection_*

falsepositives:
  - Legitimate IT/security review, log shipping, or troubleshooting scripts using wevtutil or PowerShell event-log cmdlets.

level: informational

T1654 Log Enumeration

title: T1654 Log Enumeration
id: 9df45a25-1b9b-4437-9f17-2e92822bb8c6
description: 'Detection Strategy for Log Enumeration. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AdminMaintenanceScripts.'
references:
  - https://attack.mitre.org/techniques/T1654
author: Shahrukh Khan
date: 2026-05-19
license: MIT
tags:
  - attack.discovery
  - attack.t1654

logsource:
  category: process_creation
  product: linux

detection:
  selection_tools:
    exe|endswith:
      - '/journalctl'
      - '/ausearch'
      - '/aureport'
      - '/last'
      - '/lastlog'
  selection_targets:
    a1|contains:
      - '/var/log/auth.log'
      - '/var/log/secure'
      - '/var/log/audit/audit.log'
      - '/var/log/wtmp'
      - '/var/log/btmp'
  filter_admin:
    exe|endswith: '/logrotate'

  condition: (selection_tools or selection_targets) and not filter_admin

falsepositives:
  - Routine log review by SOC/sysadmins, logrotate/log-shipping agents, and audit compliance checks reading the same log paths.

level: low

T1654 Log Enumeration

title: T1654 Log Enumeration
id: eabea24a-e69f-4cb0-8df4-edd51f84266d
description: 'Detection Strategy for Log Enumeration. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DebugToolsContext.'
references:
  - https://attack.mitre.org/techniques/T1654
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.discovery
  - attack.t1654

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/log'
    CommandLine|contains|all:
      - 'show'
      - '--predicate'

  condition: selection

falsepositives:
  - Legitimate troubleshooting or support sessions that use the log command to review recent system activity.

level: low

T1654 Log Enumeration

title: T1654 Log Enumeration
id: daa54193-2e12-40ac-9b84-2586be4463d9
description: 'Detection Strategy for Log Enumeration. (Data Component: Command Execution; baseline tier: fallback.) Tune using: LogExportThreshold.'
references:
  - https://attack.mitre.org/techniques/T1654
author: Shahrukh Khan
date: 2026-01-23
license: MIT
tags:
  - attack.discovery
  - attack.t1654

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_find_logs:
    type: EXECVE
    a0|endswith: '/find'
    a1|contains: '/var/log'
  selection_cat_logs:
    type: EXECVE
    a0|endswith:
      - '/cat'
      - '/grep'
    a1|contains: '/var/log'
  selection_journalctl:
    type: EXECVE
    a0|endswith: '/journalctl'

  condition: 1 of selection_*

falsepositives:
  - Routine log review by administrators, log rotation utilities, and SIEM forwarders that read log directories as part of normal operation.

level: low

T1654 Log Enumeration

title: T1654 Log Enumeration
id: abdd2223-e3f7-4247-8f4e-c6b9372a16da
description: 'Detection Strategy for Log Enumeration. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AdminSessions.'
references:
  - https://attack.mitre.org/techniques/T1654
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.discovery
  - attack.t1654

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection_log:
    CommandLine|contains:
      - '/var/log/hostd.log'
      - '/var/log/vmkernel.log'
      - '/var/log/auth.log'
      - '/var/log/shell.log'
  selection_cmd:
    CommandLine|contains:
      - 'cat '
      - 'grep '
      - 'less '
      - 'tail '

  condition: selection_log and selection_cmd

falsepositives:
  - Support engineers and administrators routinely read log files during legitimate troubleshooting sessions from AdminSessions; only elevated in priority when this precedes a subsequent log-tampering or deletion command.

level: low

Explore