Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1654_log-enumeration
Adversaries may enumerate system and service logs to find useful data.
Passed 20 of 23 test cases with the skill, and 14 of 23 without it.
and 4 more in the full report
6 fixed14 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our vulnerability management team needs to know which operating systems and environments are in scope for ATT&CK technique T1654 host log inspection assessments. Some teams restrict this to Windows only. Which five platforms are explicitly in scope?
| Checked | Without skill | With skill |
|---|---|---|
| Includes ESXi, IaaS, Linux, macOS, and Windows in the target platforms list. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records (Account Discovery), security or vulnerable software (Software Discovery), or hosts within a compromised network (Remote System Discovery).
Host binaries may be leveraged to collect system logs. Examples include using wevtutil.exe or PowerShell on Windows to access and/or export security event information. In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s CollectGuestLogs.exe to collect security logs from cloud hosted infrastructure.
Adversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis.
In addition to gaining a better understanding of the environment, adversaries may also monitor logs in real time to track incident response procedures. This may allow them to adjust their techniques in order to maintain persistence or evade defenses.
Platforms: ESXi, IaaS, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Uses the built-in PowerShell commandlet Get-EventLog to search for 'SYSTEM' keyword and saves results to a text file.
This technique was observed in a TheDFIRReport case where the threat actor enumerated the Windows Security audit log to determine user accounts and associated IPv4 addresses.
test cases passed, vs 14 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.