AN0705
Analytic 0705
Windows
Monitor for use of native utilities such as wevtutil.exe or PowerShell cmdlets (Get-WinEvent, Get-EventLog) to enumerate or export logs. Unusual access to security or system event channels, especially by non-administrative users or processes, should be correlated with subsequent file export or network transfer activity.
WinEventLog:Security
EventCode=4688
WinEventLog:Security
EventCode=4663, 4670, 4656
[WhitelistedAdminTools]
Expected log management scripts executed by administrators should be excluded from alerts.
[TimeWindow]
Correlate enumeration attempts with file export or network transfer within a defined timeframe.
AN0706
Analytic 0706
Linux
Monitor for suspicious use of commands such as cat, less, grep, or journalctl accessing /var/log/ files. Abnormal enumeration of authentication logs (auth.log, secure) or bulk access to multiple logs in short time windows should be flagged.
auditd:SYSCALL
execve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)
auditd:PATH
open: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)
[AdminMaintenanceScripts]
Filter routine scripts used for log rotation or troubleshooting.
AN0707
Analytic 0707
macOS
Detect abnormal access to unified logs via log show or fs_usage targeting system log files. Monitor for execution of shell utilities (cat, grep) against /var/log/system.log and for plist modifications enabling verbose logging.
macos:unifiedlog
Execution of log show, fs_usage, or cat targeting system.log
macos:unifiedlog
open: Access to /var/log/system.log or related security event logs
[DebugToolsContext]
Allowlist developers or administrators expected to review logs during debugging.
AN0708
Analytic 0708
IaaS
Monitor for cloud API calls that export or collect guest or system logs. Abnormal use of Azure VM Agent’s CollectGuestLogs.exe or AWS CloudWatch GetLogEvents across multiple instances should be correlated with lateral movement or data staging.
AWS:CloudTrail
GetLogEvents: High frequency log exports from CloudWatch or equivalent services
azure:activity
CollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows
[LogExportThreshold]
Define thresholds for volume/frequency of log export requests considered suspicious.
AN0709
Analytic 0709
ESXi
Monitor ESXi shell or API access to host logs under /var/log/. Abnormal enumeration of vmkernel.log, hostd.log, or vpxa.log by unauthorized accounts should be flagged.
esxi:shell
Execution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.log
esxi:hostd
read: Access to sensitive log files by non-admin users
[AdminSessions]
Correlate with legitimate administrator access sessions to reduce noise.