AN0706: Analytic 0706
Monitor for suspicious use of commands such as cat, less, grep, or journalctl accessing /var/log/ files. Abnormal enumeration of authentication logs (auth.log, secure) or bulk access to multiple logs in short time windows should be flagged.
Analyst context for executives and security teams
This analytic is about spotting unusual Linux log review activity, such as users or processes using tools like cat, less, grep, or journalctl to access files under /var/log/. For leaders, the value is not that reading logs is always malicious—it often is normal administration—but that abnormal or bulk access to authentication and system logs can be an important early signal during an investigation or monitoring program.
Executive priority
Treat this as a validation point for Linux monitoring maturity. Security leaders should ask whether the organization can distinguish routine administrator troubleshooting from unusual enumeration of authentication logs such as auth.log or secure. The business value is stronger SOC triage, better incident response evidence, and clearer audit confidence around privileged activity on Linux systems.
Technical view
For Linux environments, validate visibility into command execution and log file access involving cat, less, grep, journalctl, and /var/log/ paths. Since ATT&CK provides no tactic, relationship context, or detailed detection logic for this analytic, teams should implement it as behavioral monitoring: unusual users, unusual hosts, short-window bulk access to multiple logs, or unexpected access to authentication logs. Tuning should account for administrators, monitoring agents, log shippers, and troubleshooting workflows.
Likely telemetry
- Linux process execution telemetry with command-line arguments
- File access telemetry for /var/log/ paths where available
- Authentication log access events for auth.log or secure
- journalctl invocation records
- User, host, and time-window context for baseline comparison
Detection direction
- Baseline normal Linux administrative and monitoring activity before treating log access as suspicious.
- Flag bulk access to multiple /var/log/ files in short time windows, especially by unusual users or on unusual hosts.
- Prioritize access to authentication logs such as auth.log or secure when it deviates from expected operations.
- Tune out known log collection, backup, monitoring, and troubleshooting activity to reduce false positives.
- Because no official detection logic is supplied, validate locally with real telemetry and documented administrative use cases.
Mitigation priorities
- Ensure Linux command execution and relevant file access telemetry are collected where risk justifies it.
- Restrict access to sensitive logs to authorized administrators and service accounts.
- Document expected log review, log shipping, and troubleshooting workflows for SOC tuning.
- Use least privilege and account governance to reduce unnecessary access to authentication logs.
- Maintain incident response procedures that preserve log access evidence without assuming every log read is malicious.
Analyst notes and limits
This object is a detection analytic, AN0706, for Linux. The supplied ATT&CK content focuses on suspicious command use against /var/log/ files and abnormal enumeration of authentication logs. There are no supplied relationships, tactics, aliases, or official detection logic, so this take emphasizes validation questions and telemetry requirements rather than a specific rule.
The source fields do not provide a tactic, mapped technique, detection query, data source list, or relationship context. Any assessment of severity, adversary use, coverage, or business exposure requires local environment evidence and tuning.
Analytic 0706
Monitor for suspicious use of commands such as cat, less, grep, or journalctl accessing /var/log/ files. Abnormal enumeration of authentication logs (auth.log, secure) or bulk access to multiple logs in short time windows should be flagged.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | d3d6af319d1c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0706Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.