Log

Access Control Configuration

Access Control Group

Access Control List

Access Token

Activity Dependency

Address Space

Administrative Network Traffic

Alias

Allocate Memory

Application

Application Configuration

Application Configuration Database

Application Configuration Database Record

Application Configuration File

Application Installer

Application Inventory Sensor

Application Layer Firewall

Application Layer Link

Application Process

Application Process Configuration

Application Rule

Application Shim

Archive File

Artifact Server

Asymmetric Key

Audio Input Device

Authenticate User

Authentication

Authentication Function

Authentication Log

Authentication Server

Authentication Service

Authorization

Authorization Log

Authorization Service

Barcode Scanner Input Device

Binary Large Object

Binary Segment

Blob

Block Device

Boot Loader

Boot Record

Boot Sector

Browser

Browser Extension

Build Tool

Business Communication Platform Client

CA Certificate File

Processor Cache Memory

Call Stack

Central Processing Unit

Certificate

Certificate File

Certificate Trust Store

Chatroom Client

Child Process

Client Application

Client Computer

Clipboard

Cloud Configuration

Cloud Instance Metadata

Cloud Service Authentication

Cloud Service Authorization

Cloud Service Sensor

Cloud Storage

Cloud User Account

Code Analyzer

Code Repository

Collaborative Software

Network Agent

Command

Command History Log

Command History Log File

Command Line Interface

Compiler

Compiler Configuration File

Computing Server

Configuration Database

Configuration Database Record

Configuration File

Configuration Management Database

Configuration Resource

Connect Socket

Console Output Function

Container Build Tool

Container Image

Container Orchestration Software

Container Process

Container Runtime

Copy Memory Function

Copy Token

Create File

Create Process

Create Socket

Create Thread

Credential

Credential Management System

Cryptographic Key

Custom Archive File

DHCP Network Traffic

DHCP Server

DNS Lookup

DNS Network Traffic

DNS Record

DNS Server

Data Artifact Server

Data Dependency

Data Link Link

Database

Database File

Database Query

Database Server

Decoy Artifact

Default User Account

Delete File

Dependency

Deserialization Function

Desktop Computer

Developer Application

Dial Up Modem

Digital Artifact

Digital Fingerprint

Digital System

Directory

Directory Service

Display Adapter

Display Device Driver

Display Server

Document File

Domain Name

Domain Registration

Domain User Account

Dynamic Analysis Tool

Email Attachment

Email Rule

Embedded Computer

Enclave

Encrypted Credential

Encrypted Password

Endpoint Sensor

Eval Function

Event Log

Exception Handler

Exec

Executable Binary

Executable File

Executable Script

External Content Inclusion Function

Fast Symbolic Link

File

File Hash

File Path Open Function

File Section

File Server

File Share Service

File System

File System Link

File System Metadata

File System Sensor

File Transfer Network Traffic

Finger Print Scanner Input Device

Firewall

Firmware

Firmware Sensor

First-stage Boot Loader

Flash Memory

Forward Proxy Server

Free Memory

Get Open Sockets

Get Open Windows

Get Running Processes

Get Screen Capture

Get System Config Value

Get System Network Config Value

Get System Time

Global User Account

Graphical User Interface

Graphics Card Firmware

Graphics Processing Unit

Group Policy

HTML File

Hard Disk Firmware

Hard Link

Hardware Device

Hardware Driver

Heap Segment

Host

Host-based Firewall

Host Configuration Sensor

Host Group

Hostname

Human Input Device Firmware

IP Address

IPC Network Traffic

IP Phone

Identifier

Image Code Segment

Image Data Segment

Image Scanner Input Device

Image Segment

Impersonate User

Import Library Function

In-memory Password Store

Inbound Internet DNS Response Traffic

Inbound Internet Mail Traffic

Inbound Internet Network Traffic

Inbound Network Traffic

Init Script

Input Device

Input Function

Instant Messaging Client

Integration Test Execution Tool

Internet DNS Lookup

Internet File Transfer Traffic

Internet Network

Internet Network Traffic

Interprocess Communication

Intranet Administrative Network Traffic

Intranet DNS Lookup

Intranet File Transfer Traffic

Intranet IPC Network Traffic

Intranet Multicast Network Traffic

Intranet Network

Intranet Network Traffic

Intranet RPC Network Traffic

Intranet Web Network Traffic

Intrusion Detection System

Intrusion Prevention System

Java Archive

JavaScript Blob

Job Schedule

Job Scheduler Software

Kerberos Ticket

Kerberos Ticket Granting Service Ticket

Kerberos Ticket Granting Ticket

Kernel

Kernel API Sensor

Kernel Module

Kernel Process Table

Keyboard Input Device

Kiosk Computer

Laptop Computer

Legacy System

Link

Linux Clone

Linux Clone3

Linux Clone3 Argument CLONE_THREAD

Linux Clone Argument CLONE_THREAD

Linux Connect

Linux Creat

Linux Execve

Linux Execveat

Linux Fork

Linux Kill Argument SIGKILL

Linux Mmap

Linux Mmap2

Linux Munmap

Linux Open Argument O_CREAT

Linux Open Argument O_RDONLY, O_WRONLY, O_RDWR

Linux OpenAt2 Argument O_CREAT

Linux OpenAt2 Argument O_RDONLY, O_WRONLY, O_RDWR

Linux OpenAt Argument O_CREAT

Linux OpenAt Argument O_RDONLY, O_WRONLY, O_RDWR

Linux Pause Process

Linux Pause Thread

Linux Ptrace Argument PTRACE_INTERRUPT

Linux Ptrace Argument PTRACE_TRACEME

Linux Read

Linux Readv

Linux Rename

Linux Renameat

Linux Renameat2

Linux Socket

Linux Socketcall Argument SYS_CONNECT

Linux Socketcall Argument SYS_SOCKET

Linux Time

Linux Unlink

Linux Unlinkat

Linux Vfork

Linux Write

Linux Writev

Linux _Exit

Local Area Network

Local Area Network Traffic

Local Authentication Service

Local Authorization Service

Local Resource

Local Resource Access

Local User Account

Log

Log File

Log Message Function

Logical Link

Logon User

MacOS Keychain

Mail Network Traffic

Mail Server

Mail Service

Mathematical Function

Media Server

Memory Address

Memory Address Space

Memory Allocation Function

Memory Block

Memory Extent

Memory Free Function

Memory Management Unit

Memory Management Unit Component

Memory Pool

Memory Protection Unit

Memory Word

Message Transfer Agent

Metadata

Microcode

Microsoft HTML Application

Mobile Phone

Modem

Mouse Input Device

Move File

Multimedia Document File

NTFS Hard Link

NTFS Junction Point

NTFS Link

NTFS Symbolic Link

Network

Network Card Firmware

Network Directory Resource

Network File Resource

Network File Share Resource

Network Flow

Network Flow Sensor

Network Init Script File Resource

Network Link

Network Node

Network Packet

Network Printer

Network Protocol Analyzer

Network Resource

Network Resource Access

Network Sensor

Network Service

Network Session

Network Time Server

Network Traffic

Network Traffic Analysis Software

OS API Allocate Memory

OS API Connect Socket

OS API Copy Token

OS API Create File

OS API Create Process

OS API Create Socket

OS API Create Thread

OS API Delete File

OS API Exec

OS API Free Memory

OS API Function

OS API Get System Time

OS API Move File

OS API Open File

OS API Private Function

OS API Read File

OS API Suspend Process

OS API Suspend Thread

OS API Terminate Process

OS API Trace Process

OS API Write File

Object File

Office Application

Office Application File

Open File

Operating System

Operating System Configuration

Operating System Configuration Component

Operating System Configuration File

Operating System Executable File

Operating System File

Operating System Log File

Operating System Packaging Tool

Operating System Process

Operating System Shared Library File

Operations Center Computer

Optical Modem

Orchestration Controller

Orchestration Server

Orchestration Worker

Outbound Internet DNS Lookup Traffic

Outbound Internet Encrypted Remote Terminal Traffic

Outbound Internet Encrypted Traffic

Outbound Internet Encrypted Web Traffic

Outbound Internet File Transfer Traffic

Outbound Internet Mail Traffic

Outbound Internet Network Traffic

Outbound Internet RPC Traffic

Outbound Internet Web Traffic

Outbound Network Traffic

Output Device

POSIX Symbolic Link

Packet Log

Page

Page Frame

Page Table

Parent Process

Partition

Partition Table

Password

Password Database

Password File

Password Manager

Password Store

Peripheral Firmware

Peripheral Hub Firmware

Personal Computer

Physical Address

Physical Link

Physical Location

Pipe

Platform

Pointer

Pointer Dereferencing Function

PowerShell Profile Script

Primary Storage

Print Server

Private Key

Privileged User Account

Process

Process Code Segment

Process Data Segment

Process Environment Variable

Process Image

Process Segment

Process Start Function

Process Tree

Processor

Processor Component

Processor Register

Property List File

Proxy Server

Public Key

Python Package

Python Script File

RAM

RDP Session

RF Node

RF Receiver

RF Transceiver

RF Transmitter

ROM

RPC Network Traffic

Radio Modem

Raw Memory Access Function

Read File

Record

Remote Authentication Service

Remote Authorization Service

Remote Command

Remote Database Query

Remote Procedure Call

Remote Resource

Remote Session

Remote Terminal Session

Removable Media Device

Resource

Resource Access

Resource Fork

Reverse Proxy Server

Router

SSH Session

Saved Instruction Pointer

Scheduled Job

Script Application Process

Second-stage Boot Loader

Secondary Storage

Security Token

Sensor

Serialization Function

Server

Service Application

Service Application Process

Service Dependency

Session

Session Cookie

Set System Config Value

Shadow Stack

Shared Computer

Shared Library File

Shared Resource Access Function

Shim

Shim Database

Shortcut File

Slow Symbolic Link

Software

Software Artifact Server

Software Deployment Tool

Software Library

Software Library File

Software Package

Software Packaging Tool

Software Patch

Source Code Analyzer Tool

Stack Component

Stack Frame

Stack Frame Canary

Stack Segment

Startup Directory

Static Analysis Tool

Storage

Stored Procedure

String Format Function

Subroutine

Suspend Process

Suspend Thread

Switch

Symbolic Link

Symmetric Key

System Call

System Config System Call

System Configuration Database

System Configuration Database Record

System Configuration Init Database Record

System Configuration Init Resource

System Dependency

System Firewall Configuration

System Firmware

System Init Configuration

System Init Process

System Init Script

System Password Database

System Service Software

System Software

System Startup Directory

System Time Application

System Utilization Record

TFTP Network Traffic

TFTP Server

Tablet Computer

Terminate Process

Tertiary Storage

Test Execution Tool

Thin Client Computer

Thread

Thread Start Function

Ticket Granting Ticket

Trace Process

Translation Lookaside Buffer

Transport Link

Trust Store

URL

Unit Test Execution Tool

Unix Hard Link

Unix Link

User

User Account

User Action

User Application

User Behavior

User Group

User Init Configuration File

User Init Script

User Input Function

User Interface

User Logon Init Resource

User Process

User Startup Directory

User Startup Script File

User to User Message

Utility Software

VPN Server

Version Control Tool

Video Input Device

Virtual Address

Virtual Memory Space

Virtualization Software

Volume

Volume Boot Record

Web API Resource

Web Application Firewall

Web Application Server

Web Authentication

Web File Resource

Web Network Traffic

Web Resource

Web Resource Access

Web Script File

Web Server

Web Server Application

Wide Area Network

Windows NtAllocateVirtualMemory

Windows NtAllocateVirtualMemoryEx

Windows NtCreateFile

Windows NtCreateMailslotFile

Windows NtCreateNamedPipeFile

Windows NtCreatePagingFile

Windows NtCreateProcess

Windows NtCreateProcessEx

Windows NtCreateThread

Windows NtCreateThreadEx

Windows NtDeleteFile

Windows NtDuplicateToken

Windows NtFreeVirtualMemory

Windows NtOpenFile

Windows NtOpenProcess

Windows NtQuerySystemTime

Windows NtReadFile

Windows NtReadFileScatter

Windows NtSetInformationFile Argument FileDispositionInformation

Windows NtSuspendProcess

Windows NtSuspendThread

Windows NtTerminateProcess

Windows NtWriteFile

Windows NtWriteFileGather

Windows Registry

Windows Registry Key

Windows Registry Value

Windows Shortcut File

Wireless Access Point

Wireless Router

Write File

Zero Client Computer

Properties

id: d3f:Log

name: Log
definition: A record of events in the order of their occurrence.
synonyms: Chronology
defined by: http://wordnet-rdf.princeton.edu/id/06515215-n
see also: http://dbpedia.org/resource/Chronology

json

Neighbors

        graph LR;

    d3f:LogFile["Log File"] --> | contains | d3f:Log["Log"];

            class d3f:LogFile inbound_node;
            style d3f:LogFile fill:#fff4dd;

            class d3f:Log RootArtifactNode;
            style d3f:Log fill:#fff4dd;

            click d3f:LogFile href "/dao/artifact/d3f:LogFile";
            click d3f:Log href "/dao/artifact/d3f:Log";

Inferred Relationships

This page is experimental and may change significantly in future releases.

Hierarchy

(filtered)

Related Countermeasure Techniques

No related defensive techniques in this release.

Related Weaknesses

Log has no related weaknesses in this release.

Related Offensive Techniques

        graph LR;

    T1187["Forced Authentication"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1187 OffensiveTechniqueNode;
        class AuthenticationLog ArtifactNode; click T1187 href "/offensive-technique/attack/T1187/"; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog";T1110001["Password Guessing"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1110001 OffensiveTechniqueNode;
        class AuthenticationLog ArtifactNode; click T1110001 href "/offensive-technique/attack/T1110.001/"; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog";T1110003["Password Spraying"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1110003 OffensiveTechniqueNode;
        class AuthenticationLog ArtifactNode; click T1110003 href "/offensive-technique/attack/T1110.003/"; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog";T1110004["Credential Stuffing"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1110004 OffensiveTechniqueNode;
        class AuthenticationLog ArtifactNode; click T1110004 href "/offensive-technique/attack/T1110.004/"; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog";T1070003["Clear Command History"] --> |modifies| CommandHistoryLog["Command History Log"]; class T1070003 OffensiveTechniqueNode;
        class CommandHistoryLog ArtifactNode; click T1070003 href "/offensive-technique/attack/T1070.003/"; click CommandHistoryLog href "/dao/artifact/d3f:CommandHistoryLog";T1003006["DCSync"] --> |may-modify| EventLog["Event Log"]; class T1003006 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1003006 href "/offensive-technique/attack/T1003.006/"; click EventLog href "/dao/artifact/d3f:EventLog";T1140["Deobfuscate/Decode Files or Information"] --> |may-modify| EventLog["Event Log"]; class T1140 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1140 href "/offensive-technique/attack/T1140/"; click EventLog href "/dao/artifact/d3f:EventLog";T1070001["Clear Windows Event Logs"] --> |modifies| EventLog["Event Log"]; class T1070001 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1070001 href "/offensive-technique/attack/T1070.001/"; click EventLog href "/dao/artifact/d3f:EventLog";T1134002["Create Process with Token"] --> |may-modify| EventLog["Event Log"]; class T1134002 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1134002 href "/offensive-technique/attack/T1134.002/"; click EventLog href "/dao/artifact/d3f:EventLog";T1134003["Make and Impersonate Token"] --> |may-modify| EventLog["Event Log"]; class T1134003 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1134003 href "/offensive-technique/attack/T1134.003/"; click EventLog href "/dao/artifact/d3f:EventLog";T1548003["Sudo and Sudo Caching"] --> |may-modify| EventLog["Event Log"]; class T1548003 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1548003 href "/offensive-technique/attack/T1548.003/"; click EventLog href "/dao/artifact/d3f:EventLog";T1546003["Windows Management Instrumentation Event Subscription"] --> |modifies| EventLog["Event Log"]; class T1546003 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1546003 href "/offensive-technique/attack/T1546.003/"; click EventLog href "/dao/artifact/d3f:EventLog";T1546005["Trap"] --> |modifies| EventLog["Event Log"]; class T1546005 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1546005 href "/offensive-technique/attack/T1546.005/"; click EventLog href "/dao/artifact/d3f:EventLog";T1003005["Cached Domain Credentials"] --> |may-modify| Log["Log"]; class T1003005 OffensiveTechniqueNode;
        class Log ArtifactNode; click T1003005 href "/offensive-technique/attack/T1003.005/"; click Log href "/dao/artifact/d3f:Log";