Techniques › T1082
T1082 System Information Discovery
discovery — ESXi, IaaS, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
6
analytics
33
Sigma rules tagged attack.t1082
7
KEV CVEs mapped here
<p>An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.</p><p>Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the <code>systemsetup</code> configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. <code>show version</code>). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as
system hostname get and system version get.</p><p>Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.</p><p>System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-23692 | Rejetto HTTP File Server | primary impact | Mapped | 2024-07-09 |
| CVE-2023-43770 | Roundcube Webmail | secondary impact | Mapped | 2024-02-12 |
| CVE-2023-34362 | Progress MOVEit Transfer | secondary impact | Mapped | 2023-06-02 |
| CVE-2021-40449 | Microsoft Windows | secondary impact | Mapped | 2021-11-17 |
| CVE-2019-1653 | Cisco Small Business RV320 and RV325 Routers | primary impact | Mapped | 2021-11-03 |
| CVE-2020-8195 | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | primary impact | Mapped | 2021-11-03 |
| CVE-2020-8196 | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | primary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0525 System Discovery via Native and Remote Utilities v1.0
AN1452 WindowsDetection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.Tunable:
TimeWindowUserContextAN1453 LinuxExecution of system enumeration commands such asuname,df,uptime,hostname,lscpu, andcat /etc/os-releasethrough local terminal or scripts.Tunable:CommandListTerminalSessionIDAN1454 macOSExecution of system info utilities likesystemsetup,sw_vers,uname, orsysctlby terminal or scripted processes.Tunable:ParentProcessFrequencyThresholdAN1455 ESXiExecution ofesxcli system hostname get,esxcli system version get, oresxcli hardwarecommands through SSH or local shell.Tunable:SessionOriginCommandStringAN1456 IaaSUse of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.Tunable:IAMRoleContextAPIFrequencyAN1457 Network DevicesExecution ofshow version,show hardware, orshow systemcommands through CLI via SSH or console.Tunable:UsernameCommandList
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1082
Author: lazarg
· 2025-06-12 (modified 2025-10-25) · logsource: product=windows category=process_creation · 0022869c-49f7-4ff2-ba03-85ac42ddac58
Detects attempts to query system information directly from the Windows Registry.
Author: frack113
· 2022-01-01 (modified 2022-07-14) · logsource: product=windows category=process_creation · 0ef56343-059e-4cb6-adc1-4c3c967c5e46
Detects usage of the "systeminfo" command to retrieve information
Author: Seth Hanford
· 2023-08-23 · logsource: product=linux category=process_creation · 11701de9-d5a5-44aa-8238-84252f131895
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Author: Ömer Günal, oscd.community
· 2020-10-08 (modified 2022-11-26) · logsource: product=linux service=auditd · 1f358e2e-cb63-43c3-b575-dfb072a6814f
Detects system information discovery commands
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-12-20 (modified 2024-01-02) · logsource: product=macos category=process_creation · 2d5e7a8b-f484-4a24-945d-7f0efd52eab0
Detects the use of "ioreg" which will show I/O Kit registry information.
This process is used for system information discovery.
It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.
Author: Ömer Günal, oscd.community
· 2020-10-08 (modified 2021-09-14) · logsource: product=linux category=process_creation · 42df45e7-e6e9-43b5-8f26-bec5b39cc239
Detects system information discovery commands
Author: Seth Hanford
· 2023-08-23 (modified 2025-11-24) · logsource: product=linux category=process_creation · 43e26eb5-cd58-48d1-8ce9-a273f5d298d8
Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.
Author: Stephen Lincoln `@slincoln_aiq` (AttackIQ)
· 2024-01-02 · logsource: product=macos category=process_creation · 4809c683-059b-4935-879d-36835986f8cf
Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
Author: frack113
· 2022-01-22 (modified 2024-03-19) · logsource: product=windows category=process_creation · 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
Detects the use of the redirection character ">" to redirect information on the command line.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · 5259cbf2-0a75-48bf-b57a-c54d6fabaef3
Detects user data export activity.
Author: Florian Roth (Nextron Systems)
· 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-12-20 · logsource: product=macos category=process_creation · 5de06a6f-673a-4fc0-8d48-bcfe3837b033
Detects the use of "sw_vers" for system information discovery
Author: Pratinav Chandra
· 2024-05-27 · logsource: product=macos category=process_creation · 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c
Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information.
This process is primarily used to detect and avoid virtualization and analysis environments.
Author: Florian Roth (Nextron Systems)
· 2021-12-28 · logsource: product=windows category=process_creation · 7124aebe-4cd7-4ccb-8df0-6d6b93c96795
Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1
Author: Seth Hanford
· 2023-08-23 · logsource: product=linux category=process_creation · 746c86fb-ccda-4816-8997-01386263acc4
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
Author: frack113
· 2022-01-01 · logsource: product=windows category=process_creation · 7be5fb68-f9ef-476d-8b51-0256ebece19e
Use of hostname to get information
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · 87cc6698-3e07-4ba2-9b43-a85a73e151e2
Detects user permission data export attempt.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b
Find information about network devices that is not stored in config files
Author: Georg Lauenstein (sure[secure])
· 2022-09-19 (modified 2023-03-23) · logsource: product=windows category=process_creation · 98b53e78-ebaf-46f8-be06-421aafd176d9
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Author: TropChaud
· 2023-01-26 (modified 2023-12-19) · logsource: product=windows category=process_creation · 9d5a1274-922a-49d0-87f3-8c653483b909
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,
including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS,
and GPU driver products/versions.
Some of these commands were used by Aurora Stealer in late 2022/early 2023.
Author: Milad Cheraghi
· 2025-05-30 (modified 2025-12-05) · logsource: product=linux service=auditd · b207d563-a1d9-4275-b349-77d1eb55aa6d
Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.
Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.
Author: Janantha Marasinghe
· 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Author: Stephen Lincoln '@slincoln-aiq' (AttackIQ)
· 2024-02-02 (modified 2025-10-20) · logsource: product=windows category=process_creation · c79da740-5030-45ec-a2e0-479e824a562c
An adversary might use WMI to discover information about the system, such as the volume name, size,
free space, and other disk information. This can be done using the 'wmic' command-line utility and has been
observed being used by threat actors such as Volt Typhoon.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-06-02 · logsource: product=linux category=process_creation · d27ab432-2199-483f-a297-03633c05bae6
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-12-19 (modified 2024-01-15) · logsource: product=windows category=process_creation · d85ecdd7-b855-4e6e-af59-d9c78b5b861e
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,
including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS,
and GPU driver products/versions.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-06-02 · logsource: product=linux category=process_creation · e34cfa0c-0a50-4210-9cb3-5632d08eb041
Detects the use of grep to discover specific files created by the GobRAT malware
Author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2023-02-14 (modified 2025-03-17) · logsource: product=windows category=process_creation · e568650b-5dcd-4658-8f34-ded0b1e13992
Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products.
Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.
This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.
Author: Florian Roth (Nextron Systems)
· 2022-02-07 · logsource: product=windows category=process_creation · e6313acd-208c-44fc-a0ff-db85d572e90e
Detects a set of suspicious network related commands often used in recon stages
Author: Pawel Mazur
· 2021-09-03 (modified 2023-03-06) · logsource: product=linux service=auditd · f34047d9-20d3-4e8b-8672-0a35cc50dc71
Detects System Information Discovery commands
Author: frack113
· 2022-01-01 · logsource: product=windows category=process_creation · f5240972-3938-4e56-8e4b-e33893176c1f
Use of reg to get MachineGuid information
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
· 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · fca949cc-79ca-446e-8064-01aa7e52ece5
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff