Log Enumeration
Technique · ATTACK:enterprise:T1654
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1654",
"title": "Log Enumeration",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1654",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--866d0d6d-02c6-42bd-aa2f-02907fdc0969",
"external_id": "T1654",
"domain": "enterprise",
"created": "2023-07-10T16:50:57.587Z",
"modified": "2025-04-15T19:58:48.705Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
{
"source_name": "Permiso GUI-Vil 2023",
"url": "https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor/"
},
{
"source_name": "SIM Swapping and Abuse of the Microsoft Azure Serial Console",
"url": "https://www.mandiant.com/resources/blog/sim-swapping-abuse-azure-serial"
},
{
"source_name": "Cadet Blizzard emerges as novel threat actor",
"url": "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"
},
{
"source_name": "WithSecure Lazarus-NoPineapple Threat Intel Report 2023",
"url": "https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d3409c6-fbfd-486a-90ee-dc71e48a36d2
ESET Contagious Interview BeaverTail InvisibleFerret February 2025ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35423c2b-7b57-423b-8573-6f6cf2cd22ec
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36ac187b-e0a4-4603-8c83-49d71f88df7b
CISA GRU29155 2024ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--510fefe4-1f76-4c33-a447-2f85e3dc87e2
ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6848a6be-5571-4e88-b95d-45d9a11d4758
CISA AA24-038A PRC Critical Infrastructure February 2024 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72c13b6e-3134-4b0f-a51b-123db35ae080
Crowdstrike HuntReport 2022ATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a938acf-f072-42ba-8b5f-16e78ebea7f7
GitHub PacuATTACK:enterprise:S1191 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a3ce7a9-f3b9-4387-bd7e-a1cf1b8c8f67
Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c0b8bff-6cfe-4b12-843c-19985efd2d3b
Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a53771f3-24ed-4799-a1e8-8cf747cbfe4d
Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2a5153d-95fa-41b3-8d5f-d99d2b0b1aa4
Google Cloud APT41 2024