SCCM log files enumeration

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-12-01

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags	Microsoft SCCM Analytics
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Log Enumeration (T1654)
Severity	Informational

Multiple local SCCM logs were accessed within a short period of time.

Enumerate data about the SCCM configuration, infrastructure and deployments.

Check suspicious network connections from the process or host.
Check if the user account that initiated the enumeration is supposed to access these files.

Multiple local SCCM logs were abnormally accessed within a short period of time.

Enumerate data about the SCCM configuration, infrastructure and deployments.

Check suspicious network connections from the process or host.
Check if the user account that initiated the enumeration is supposed to access these files.