type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0038
external_id: DC0038
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Application Log Content
description: Application Log Content refers to logs generated by applications or services, providing a record of their activity. These logs may include metrics, errors, performance data, and operational alerts from web, mail, or other applications. These logs are vital for monitoring application behavior and detecting malicious activities or anomalies. Examples: 

- Web Application Logs: These logs include information about requests, responses, errors, and security events (e.g., unauthorized access attempts).
- Email Application Logs: Logs contain metadata about emails sent, received, or blocked (e.g., sender/receiver addresses, message IDs).
- SaaS Application Logs: Activity logs include user logins, configuration changes, and access to sensitive resources.
- Cloud Application Logs: Logs detail control plane activities, including API calls, instance modifications, and network changes.
- System/Application Monitoring Logs: Logs provide insights into application performance, errors, and anomalies.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Application Log
channel: None
name: WinEventLog:Application
channel: Outlook errors loading or processing custom form templates
name: m365:unified
channel: Unusual form activity within Outlook client, including load of non-default forms
name: saas:okta
channel: Conditional Access policy rule modified or MFA requirement disabled
name: ApplicationLog:EntraIDPortal
channel: DeviceRegistration events
name: ApplicationLog:Intune/MDM Logs
channel: Enrollment events (e.g., MDMDeviceRegistration)
name: m365:purview
channel: MailItemsAccessed & Exchange Audit
name: m365:purview
channel: MailItemsAccessed, Search-Mailbox events
name: WinEventLog:Application
channel: Office Add-in load errors, abnormal loading context, or unsigned add-in warnings
name: m365:unified
channel: SendOnBehalf, MessageSend, ClickThrough, MailItemsAccessed
name: Application:Mail
channel: smtpd$.*$: .*from=[.*@internaldomain.com](mailto:.*@internaldomain.com) to=[.*@internaldomain.com](mailto:.*@internaldomain.com)
name: saas:slack
channel: file_upload, message_send, message_click
name: saas:teams
channel: ChatMessageSent, ChatMessageEdited, LinkClick
name: saas:gmail
channel: SendEmail, OpenAttachment, ClickLink
name: m365:unified
channel: SendOnBehalf, MessageSend, AttachmentPreviewed
name: WinEventLog:System
channel: Changes to applicationhost.config or DLLs loaded by w3wp.exe
name: WinEventLog:Security
channel: EventCode=6416
name: WinEventLog:System
channel: Device started/installed (UMDF) GUIDs
name: linux:syslog
channel: usb * new|thunderbolt|pci .* added|block.*: new .* device
name: macos:unifiedlog
channel: Device attached|enumerated VID/PID
name: m365:unified
channel: Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types
name: Application:Mail
channel: Inbound messages with anomalous headers, spoofed SPF/DKIM failures
name: macos:unifiedlog
channel: Inbound email activity with suspicious domains or mismatched sender information
name: m365:unified
channel: FileAccessed: Access of email attachments by Office applications
name: saas:collaboration
channel: MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)
name: ApplicationLog:IIS
channel: IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)
name: ApplicationLog:WebServer
channel: /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors
name: macos:unifiedlog
channel: App/web server logs ingested via unified logging or filebeat (nginx/apache/node).
name: ApplicationLog:Ingress
channel: Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes
name: esxi:hostd
channel: /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections
name: esxi:vmkernel
channel: vmkernel / OpenSLP logs for malformed requests
name: networkdevice:controlplane
channel: Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands
name: WinEventLog:Application
channel: Outlook rule execution failure or abnormal rule execution context
name: m365:unified
channel: Creation or modification of inbox rule outside of normal user behavior
name: m365:unified
channel: Send/Receive: Inbound emails containing embedded or shortened URLs
name: Application:Mail
channel: Inbound emails containing hyperlinks from suspicious sources
name: macos:unifiedlog
channel: Received messages with embedded or shortened URLs
name: azure:signinlogs
channel: ConsentGrant: Suspicious consent grants to non-approved or unknown applications
name: m365:unified
channel: AppRegistration: Unexpected application registration or OAuth authorization
name: m365:unified
channel: MessageSend, MessageRead, or FileAttached events containing credential-like patterns
name: m365:exchange
channel: Emails containing cleartext secrets (password=, api_key=, token=) shared across internal/external domains
name: saas:slack
channel: chat.postMessage, files.upload, or discovery API calls involving token/credential regex
name: linux:syslog
channel: Inbound messages from webmail services containing attachments or URLs
name: macos:unifiedlog
channel: Received messages containing embedded links or attachments from non-enterprise services
name: WinEventLog:System
channel: EventCode=1000
name: linux:syslog
channel: kernel|systemd messages indicating 'segmentation fault'|'core dumped'|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc.
name: esxi:hostd
channel: Keywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log.
name: macos:unifiedlog
channel: process 'crashed'|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons.
name: esxi:hostd
channel: unexpected script/command invocations via hostd
name: linux:syslog
channel: System daemons initiating encrypted sessions with unexpected destinations
name: esxi:vpxd
channel: Symmetric crypto routines triggered for external session
name: AWS:CloudTrail
channel: SendEmail
name: AWS:CloudTrail
channel: InvokeModel
name: saas:openai
channel: High volume of requests to /v1/chat/completions or /v1/images/generations
name: m365:unified
channel: Set-Mailbox, Add-InboxRule, RegisterWebhook
name: saas:application
channel: High-frequency invocation of SMS-related API endpoints from publicly accessible OTP or verification forms (e.g., Twilio: SendMessage, Cognito: AdminCreateUser) with irregular destination patterns.
name: NSM:Connections
channel: PushNotificationSent
name: saas:okta
channel: MFAChallengeIssued
name: WinEventLog:Application
channel: Exchange Transport Service loads unusual .NET assembly or errors upon transport agent execution
name: linux:syslog
channel: milter configuration updated, transport rule initialized, unexpected script execution
name: WinEventLog:Application
channel: Unexpected spikes in request volume, application-level errors, or thread pool exhaustion in web or API logs
name: linux:syslog
channel: Repetitive HTTP 408, 500, or 503 errors logged within short timeframe
name: macos:unifiedlog
channel: opendirectoryd crashes or abnormal authentication errors
name: m365:unified
channel: ConsentGranted: Abuse of application integrations to mint tokens bypassing MFA
name: WinEventLog:Application
channel: Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events
name: linux:syslog
channel: Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads
name: macos:unifiedlog
channel: Logs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches
name: m365:unified
channel: Application Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise
name: WinEventLog:Application
channel: Outlook logs indicating failure to load or render HTML page in Home Page view
name: m365:unified
channel: Folder configuration updated with external or HTML-formatted Home Page via Set-MailboxFolder
name: WinEventLog:Security
channel: EventCode=1102
name: linux:cli
channel: cleared or truncated .bash_history
name: macos:unifiedlog
channel: log stream cleared or truncated
name: m365:unified
channel: PurgeAuditLogs, Remove-MailboxAuditLog
name: WinEventLog:System
channel: EventCode=104
name: WinEventLog:Application
channel: EventCode=1000
name: EDR:detection
channel: ThreatDetected, QuarantineLog
name: macos:unifiedlog
channel: quarantine or AV-related subsystem
name: EDR:detection
channel: ThreatLog
name: azure:signinlogs
channel: Modify Conditional Access Policy
name: m365:unified
channel: Set-CsOnlineUser or UpdateAuthPolicy
name: m365:unified
channel: New-InboxRule or Set-InboxRule events recorded in Exchange Online
name: ApplicationLog:MailServer
channel: Unexpected additions of sieve rules or filtering directives
name: m365:unified
channel: Transport rule or inbox rule creation events
name: ApplicationLog:Outlook
channel: Outlook client-level rule creation actions not consistent with normal user activity
name: kubernetes:orchestrator
channel: Access to orchestrator logs containing credentials (Docker/Kubernetes logs)
name: WinEventLog:Application
channel: Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server)
name: journald:systemd
channel: Repeated service restart attempts or unit failures
name: macos:unifiedlog
channel: Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console
name: docker:events
channel: Container exited with non-zero code repeatedly in short period
name: WinEventLog:Application
channel: SCCM, Intune logs
name: macos:jamf
channel: RemoteCommandExecution
name: networkdevice:syslog
channel: config push events
name: linux:syslog
channel: processes binding to non-standard ports or sshd configured on unexpected port
name: m365:unified
channel: GAL Lookup or Address Book download
name: esxi:hostd
channel: Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest
name: m365:unified
channel: Send/Receive: Inbound emails with attachments from suspicious or spoofed senders
name: Application:Mail
channel: Inbound email attachments logged from MTAs with suspicious metadata
name: macos:unifiedlog
channel: Inbound messages with attachments from suspicious domains
name: WinEventLog:Application
channel: Unexpected web application errors or CMS logs showing modification to index.html, default.aspx, or other public-facing files
name: m365:unified
channel: certificate added or modified in application credentials
name: saas:Snowflake
channel: QUERY: Large or repeated SELECT * queries to sensitive tables
name: saas:Airtable
channel: EXPORT: User-triggered data export via GUI or API
name: ApplicationLog:CallRecords
channel: Outbound or inbound calls to high-risk or blocklisted numbers
name: networkdevice:syslog
channel: SIP REGISTER, INVITE, or unusual call destination metadata
name: macos:unifiedlog
channel: Outgoing or incoming calls with non-standard caller IDs or unusual metadata
name: m365:unified
channel: Unusual MFA requests or OAuth consent events temporally aligned with user-reported vishing call
name: docker:daemon
channel: container_create,container_start
name: saas:github
channel: Bulk access to multiple files or large volume of repo requests within short time window
name: m365:exchange
channel: Transport Rule Modification
name: m365:exchange
channel: Admin Audit Logs, Transport Rules
name: saas:application
channel: High-volume API calls or traffic via messaging or webhook service
name: m365:unified
channel: Set federation settings on domain|Set domain authentication|Add federated identity provider
name: linux:syslog
channel: system daemons initiating TLS sessions outside expected services
name: m365:unified
channel: SendOnBehalf/SendAs: Emails sent where the sending identity mismatches account ownership
name: Application:Mail
channel: Mismatch between authenticated username and From header in email
name: macos:unifiedlog
channel: Mail.app or third-party clients sending messages with mismatched From headers
name: gcp:workspaceaudit
channel: SendAs: Outbound messages with alias identities that differ from primary account
name: m365:unified
channel: Set-MailboxAutoReplyConfiguration: Unexpected rule changes creating impersonated replies
name: m365:unified
channel: SendOnBehalf/SendAs: Office Suite initiated messages using impersonated identities
name: linux:syslog
channel: browser/office crash, segfault, abnormal termination
name: macos:unifiedlog
channel: process crash, abort, code signing violations
name: saas:okta
channel: WebUI access to administrator dashboard
name: m365:unified
channel: Read-only configuration review from GUI
name: saas:box
channel: User navigated to admin interface
name: azure:signinlogs
channel: Register PTA Agent or Modify AD FS trust
name: m365:unified
channel: Modify Federation Settings or Update Authentication Policy
name: saas:okta
channel: Federation configuration update or signing certificate change
name: macos:unifiedlog
channel: Configuration profile modified or new profile installed
name: journald:Application
channel: Segfault or crash log entry associated with specific application binary
name: macos:unifiedlog
channel: Crash log entries for a process receiving malformed input or known exploit patterns
name: AWS:CloudWatch
channel: Repeated crash pattern within container or instance logs
name: esxi:hostd
channel: unexpected script invocations producing long encoded strings
name: docker:runtime
channel: execution of cloud CLI tool (e.g., aws, az) inside container
name: WinEventLog:Application
channel: VPN, Citrix, or remote access gateway logs showing external IP addresses
name: NSM:Connections
channel: Failed password or accepted password for SSH users
name: ApplicationLog:API
channel: Docker/Kubernetes API access from external sources
name: m365:unified
channel: Send/Receive: Unusual spikes in inbound messages to a single recipient
name: Application:Mail
channel: High-frequency inbound mail activity to a specific recipient address
name: m365:exchange
channel: MailDelivery: High-frequency delivery of messages or attachments to a single recipient
name: macos:unifiedlog
channel: Repetitive inbound email delivery activity logged within a short time window
name: saas:confluence
channel: access.content
name: m365:unified
channel: PowerShell: Add-MailboxPermission
name: AWS:CloudTrail
channel: InvokeFunction: Unexpected or repeated invocation of functions not tied to known workflows
name: m365:exchange
channel: New-InboxRule: Automation that triggers abnormal forwarding or external link generation
name: saas:googledrive
channel: FileOpen / FileAccess: Event-driven script triggering on user file actions
name: networkdevice:syslog
channel: Failed authentication requests redirected to non-standard portals
name: saas:okta
channel: System API Call: user.read, group.read
name: esxi:hostd
channel: Host daemon command log entries related to vib enumeration
name: m365:unified
channel: Add-MailboxPermission or Set-ManagementRoleAssignment
name: WinEventLog:Application
channel: Outlook rule creation, form load, or homepage redirection
name: m365:mailboxaudit
channel: Outlook rule creation or custom form deployment
name: saas:zoom
channel: unusual web session tokens and automation patterns during login
name: WinEventLog:Application
channel: High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite)
name: linux:syslog
channel: Error/warning logs from services indicating load spike or worker exhaustion
name: macos:unifiedlog
channel: Application errors or resource contention from excessive frontend or script invocation
name: AWS:CloudWatch
channel: Elevated 5xx response rates in application logs or gateway layer
name: m365:messagetrace
channel: AuthenticationDetails=fail OR SPF=fail OR DKIM=fail OR DMARC=fail
name: linux:syslog
channel: SPF fail OR DKIM fail OR DMARC fail OR mismatched from_domain vs return_path_domain
name: macos:unifiedlog
channel: SPF fail OR DKIM fail OR DMARC fail OR mismatched header vs envelope domains
name: saas:email
channel: AuthenticationFailures (SPF/DKIM/DMARC) OR Domain Mismatch
name: WinEventLog:System
channel: EventCode=1341, 1342, 1020, 1063
name: linux:syslog
channel: suspicious DHCP lease assignment with unexpected DNS or gateway
name: macos:unifiedlog
channel: new DHCP configuration with anomalous DNS or router values
name: WinEventLog:Application
channel: Exchange logs or header artifacts
name: macos:unifiedlog
channel: Mail or AppleScript subsystem
name: m365:exchange
channel: MessageTrace logs
name: linux:syslog
channel: opened document|clicked link|segfault|abnormal termination|sandbox
name: macos:unifiedlog
channel: opened document|clicked link|EXC_BAD_ACCESS|abort|LSQuarantine
name: WinEventLog:Security
channel: EventCode=4663, 4670, 4656
name: m365:unified
channel: Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship
name: AWS:CloudTrail
channel: CreateUser|AttachRolePolicy|CreateAccessKey|UpdateAssumeRolePolicy|CreateLoginProfile
name: azure:activity
channel: Add role assignment / ElevateAccess / Create service principal
name: saas:googleworkspace
channel: OAuth2 authorization grants / Admin role assignments
name: m365:unified
channel: Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship
name: linux:syslog
channel: Authentication attempts into finance-related servers from unusual IPs or times
name: macos:unifiedlog
channel: Anomalous keychain access attempts targeting payment credentials
name: saas:finance
channel: Transaction/Transfer: Unusual or large transactions initiated outside business hours or by unusual accounts
name: saas:audit
channel: Rule/ConfigChange: Auto-forward rules, delegate assignments, or changes to financial approval workflows
name: m365:unified
channel: MailSend: Outlook messages with suspicious subject/body terms (e.g., urgent payment, wire transfer) targeting finance teams
name: m365:unified
channel: FileAccessed, FileDownloaded, SearchQueried
name: m365:unified
channel: Detection of hidden macro streams or SetHiddenAttribute actions
name: m365:unified
channel: RunMacro
name: azure:audit
channel: App registrations or consent grants by abnormal users or at unusual times
name: azure:signinlogs
channel: Resource access initiated using application credentials, not user accounts
name: saas:slack
channel: OAuth token use by unknown app client_id accessing private channels or files
name: esxi:esxupdate
channel: /var/log/esxupdate.log contains VIB installed with `--force` or `--no-sig-check` and non-standard acceptance levels
name: linux:syslog
channel: sshd sessions with unusual port forwarding parameters
name: saas:audit
channel: Application added or consent granted: Integration persisting after original user disabled
name: linux:syslog
channel: Non-standard processes negotiating SSL/TLS key exchanges
name: esxi:vpxd
channel: ESXi process initiating asymmetric handshake with external host
name: WinEventLog:Application
channel: Unusual DLL/plugin registration for IIS/SQL/Apache or unexpected error logs
name: linux:syslog
channel: Module registration or stacktrace logs indicating segmentation faults or unknown module errors
name: esxi:hostd
channel: New extension/module install with unknown vendor ID
name: m365:unified
channel: FileUploaded or FileCopied events
name: saas:salesforce
channel: DataExport, RestAPI, Login, ReportExport
name: saas:hubspot
channel: contact_viewed, contact_exported, login
name: saas:slack
channel: conversations.history, files.list, users.info, audit_logs
name: m365:unified
channel: TeamsMessageAccess, TeamsExport, ExternalAppAccess
name: m365:unified
channel: TeamsMessagesAccessedViaEDiscovery, TeamsGraphMessageExport
name: m365:unified
channel: FileAccessed
name: m365:messagetrace
channel: X-MS-Exchange-Organization-AutoForwarded
name: linux:syslog
channel: Segfaults, kernel oops, or crashes in security software processes
name: macos:unifiedlog
channel: Abnormal terminations of com.apple.security.* or 3rd-party security daemons
name: AWS:CloudTrail
channel: StopLogging, DeleteTrail, UpdateTrail: API calls that disable or modify logging services
name: m365:unified
channel: ApplicationModified, ConsentGranted: Unexpected app consent or modification events linked to security evasion