Log Enumeration (T1654) is a Discovery technique. MITRE lists ESXi, IaaS, Linux, macOS and Windows. Adversaries read system and service logs to find useful data.
Logs hold user authentication records (Account Discovery), details of security or vulnerable software (Software Discovery) and lists of hosts (Remote System Discovery).
How attackers use it
On Windows, wevtutil.exe or PowerShell can read or export security events. In cloud environments, utilities such as the Azure VM Agent's CollectGuestLogs.exe can gather logs from hosted machines. Adversaries may also go after central logging such as SIEMs, and bulk export logs to infrastructure they control for offline analysis.
MITRE adds a point defenders often miss: adversaries may watch logs in real time to follow incident response and adjust their techniques to keep persistence or evade defenses. Your investigation can be the thing being observed.
How to detect it
MITRE's analytics:
- Windows: wevtutil.exe, Get-WinEvent or Get-EventLog used to list or export logs, especially by non administrators, followed by file export or network transfer.
- Linux: cat, less, grep or journalctl against files in /var/log, especially authentication logs and bulk reads of many logs in a short time.
- macOS: log show or fs_usage against system logs, and shell tools reading system.log.
- Cloud: API calls that export guest logs, such as CollectGuestLogs.exe or CloudWatch GetLogEvents across many instances, correlated with lateral movement or data staging.
- ESXi: unauthorized access to host logs such as vmkernel.log, hostd.log or vpxa.log.
How to reduce the risk
MITRE's mitigation is User Account Management: limit the ability to access and export sensitive logs to privileged accounts where possible.
Check your own environment
Read-only:
# Windows: who can read event logs remotely
net localgroup "Event Log Readers"
# Linux: who is in groups that can read system logs
getent group adm systemd-journal
Also check access controls on your SIEM, and whether incident response channels are kept separate from systems an intruder may already read.
Quick check
Why might an attacker watch logs in real time?
To track your response and change tactics to keep access or avoid detection, per MITRE.
