{"id":"T1082","name":"System Information Discovery","url":"https://attack.mitre.org/techniques/T1082","tactics":["discovery"],"platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0525","stix_id":"x-mitre-detection-strategy--75161d5e-2b6d-4112-ab4d-338f70ea97f0","name":"System Discovery via Native and Remote Utilities","url":"https://attack.mitre.org/detectionstrategies/DET0525","analytics":[{"id":"AN1452","stix_id":"x-mitre-analytic--54bfcc92-e04c-4eac-9aa2-c10b7574088c","name":"Analytic 1452","description":"Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1452","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Detect multiple discovery commands executed in short succession."},{"field":"UserContext","description":"Scope alerts to unusual user accounts or service accounts."}],"live":true,"detection_strategies":["DET0525"],"techniques":["T1082"]},{"id":"AN1453","stix_id":"x-mitre-analytic--eca769c3-9497-4c87-b624-4003fd1b0304","name":"Analytic 1453","description":"Execution of system enumeration commands such as `uname`, `df`, `uptime`, `hostname`, `lscpu`, and `cat /etc/os-release` through local terminal or scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1453","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"CommandList","description":"Customize list of commands of interest (e.g., uname, lscpu, etc.)"},{"field":"TerminalSessionID","description":"Correlate sessions for behavior context."}],"live":true,"detection_strategies":["DET0525"],"techniques":["T1082"]},{"id":"AN1454","stix_id":"x-mitre-analytic--85a20f4b-4171-4450-a34f-17725d44aad9","name":"Analytic 1454","description":"Execution of system info utilities like `systemsetup`, `sw_vers`, `uname`, or `sysctl` by terminal or scripted processes.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1454","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log show --predicate 'process == <utility>'","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ParentProcess","description":"Determine if script or terminal executed the command."},{"field":"FrequencyThreshold","description":"Number of discovery commands in a short window."}],"live":true,"detection_strategies":["DET0525"],"techniques":["T1082"]},{"id":"AN1455","stix_id":"x-mitre-analytic--164a04c5-db61-477f-b3fa-8bf806631fbb","name":"Analytic 1455","description":"Execution of `esxcli system hostname get`, `esxcli system version get`, or `esxcli hardware` commands through SSH or local shell.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1455","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"/var/log/vmkernel.log","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-vmkernel"}],"mutable_elements":[{"field":"SessionOrigin","description":"Track SSH or console-based entry points."},{"field":"CommandString","description":"Customize detection for expected CLI queries."}],"live":true,"detection_strategies":["DET0525"],"techniques":["T1082"]},{"id":"AN1456","stix_id":"x-mitre-analytic--d664b158-5035-4e0b-a069-7a5b27ce0936","name":"Analytic 1456","description":"Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1456","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"DescribeInstances, GetConsoleOutput, DescribeImages","data_component":"DC0075","data_component_name":"Instance Enumeration","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"IAMRoleContext","description":"Limit detection to non-standard identities performing these calls."},{"field":"APIFrequency","description":"Identify enumeration sweeps by volume."}],"live":true,"detection_strategies":["DET0525"],"techniques":["T1082"]},{"id":"AN1457","stix_id":"x-mitre-analytic--3ff23082-b5c6-47c0-8d76-a2d6fa88e622","name":"Analytic 1457","description":"Execution of `show version`, `show hardware`, or `show system` commands through CLI via SSH or console.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1457","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"Privilege-level command execution","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"Username","description":"Highlight unexpected users issuing diagnostic commands."},{"field":"CommandList","description":"Tailor to vendor-specific command syntax."}],"live":true,"detection_strategies":["DET0525"],"techniques":["T1082"]}],"live":true,"version":"1.0","techniques":["T1082"]}],"sigma_rules":[{"id":"0022869c-49f7-4ff2-ba03-85ac42ddac58","title":"System Information Discovery via Registry Queries","author":"lazarg","status":"experimental","level":"low","date":"2025-06-12","modified":"2025-10-25","description":"Detects attempts to query system information directly from the Windows Registry.","references":["https://cert.gov.ua/article/6277849","https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md","https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml","techniques":["T1082"],"cves":[]},{"id":"0ef56343-059e-4cb6-adc1-4c3c967c5e46","title":"Suspicious Execution of Systeminfo","author":"frack113","status":"test","level":"low","date":"2022-01-01","modified":"2022-07-14","description":"Detects usage of the \"systeminfo\" command to retrieve information","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-1---system-information-discovery","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_systeminfo_execution.yml","techniques":["T1082"],"cves":[]},{"id":"11701de9-d5a5-44aa-8238-84252f131895","title":"Docker Container Discovery Via Dockerenv Listing","author":"Seth Hanford","status":"test","level":"low","date":"2023-08-23","modified":null,"description":"Detects listing or file reading of \".dockerenv\" which can be a sing of potential container discovery","references":["https://blog.skyplabs.net/posts/container-detection/","https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml","techniques":["T1082"],"cves":[]},{"id":"1f358e2e-cb63-43c3-b575-dfb072a6814f","title":"System and Hardware Information Discovery","author":"Ömer Günal, oscd.community","status":"stable","level":"informational","date":"2020-10-08","modified":"2022-11-26","description":"Detects system information discovery commands","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-4---linux-vm-check-via-hardware"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.discovery","attack.t1082"],"path":"rules/linux/auditd/path/lnx_auditd_system_info_discovery2.yml","techniques":["T1082"],"cves":[]},{"id":"2d5e7a8b-f484-4a24-945d-7f0efd52eab0","title":"System Information Discovery Using Ioreg","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-12-20","modified":"2024-01-02","description":"Detects the use of \"ioreg\" which will show I/O Kit registry information.\nThis process is used for system information discovery.\nIt has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.\n","references":["https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior","https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior","https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior","https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml","techniques":["T1082"],"cves":[]},{"id":"42df45e7-e6e9-43b5-8f26-bec5b39cc239","title":"System Information Discovery","author":"Ömer Günal, oscd.community","status":"stable","level":"informational","date":"2020-10-08","modified":"2021-09-14","description":"Detects system information discovery commands","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/linux/process_creation/proc_creation_lnx_system_info_discovery.yml","techniques":["T1082"],"cves":[]},{"id":"43e26eb5-cd58-48d1-8ce9-a273f5d298d8","title":"Potential Container Discovery Via Inodes Listing","author":"Seth Hanford","status":"test","level":"low","date":"2023-08-23","modified":"2025-11-24","description":"Detects listing of the inodes of the \"/\" directory to determine if the we are running inside of a container.","references":["https://blog.skyplabs.net/posts/container-detection/","https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml","techniques":["T1082"],"cves":[]},{"id":"4809c683-059b-4935-879d-36835986f8cf","title":"System Information Discovery Using System_Profiler","author":"Stephen Lincoln `@slincoln_aiq` (AttackIQ)","status":"test","level":"medium","date":"2024-01-02","modified":null,"description":"Detects the execution of \"system_profiler\" with specific \"Data Types\" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.\nThis process is primarily used for system information discovery. However, \"system_profiler\" can also be used to determine if virtualization software is being run for defense evasion purposes.\n","references":["https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html","https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf","https://ss64.com/mac/system_profiler.html","https://objective-see.org/blog/blog_0x62.html","https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/","https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.stealth","attack.t1082","attack.t1497.001"],"path":"rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml","techniques":["T1082","T1497.001"],"cves":[]},{"id":"4f4eaa9f-5ad4-410c-a4be-bc6132b0175a","title":"CMD Shell Output Redirect","author":"frack113","status":"test","level":"low","date":"2022-01-22","modified":"2024-03-19","description":"Detects the use of the redirection character \">\" to redirect information on the command line.\nThis technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as \"hostname\" and \"dir\" to files for future exfiltration.\n","references":["https://ss64.com/nt/syntax-redirection.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1082","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_cmd_redirect.yml","techniques":["T1082"],"cves":[]},{"id":"5259cbf2-0a75-48bf-b57a-c54d6fabaef3","title":"Bitbucket User Details Export Attempt Detected","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2024-02-25","modified":null,"description":"Detects user data export activity.","references":["https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html","https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts"],"logsource":{"product":"bitbucket","service":"audit"},"tags":["attack.collection","attack.reconnaissance","attack.discovery","attack.t1213","attack.t1082","attack.t1591.004"],"path":"rules/application/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml","techniques":["T1213","T1082","T1591.004"],"cves":[]},{"id":"5722dff1-4bdd-4949-86ab-fbaf707e767a","title":"PUA - System Informer Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2023-05-08","modified":"2024-11-23","description":"Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations","references":["https://github.com/winsiderss/systeminformer"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.discovery","attack.stealth","attack.t1082","attack.t1564","attack.t1543"],"path":"rules/windows/process_creation/proc_creation_win_pua_system_informer.yml","techniques":["T1082","T1564","T1543"],"cves":[]},{"id":"5de06a6f-673a-4fc0-8d48-bcfe3837b033","title":"System Information Discovery Using sw_vers","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-12-20","modified":null,"description":"Detects the use of \"sw_vers\" for system information discovery","references":["https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior","https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior","https://ss64.com/osx/sw_vers.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml","techniques":["T1082"],"cves":[]},{"id":"6ff08e55-ea53-4f27-94a1-eff92e6d9d5c","title":"System Information Discovery Via Sysctl - MacOS","author":"Pratinav Chandra","status":"test","level":"medium","date":"2024-05-27","modified":null,"description":"Detects the execution of \"sysctl\" with specific arguments that have been used by threat actors and malware. It provides system hardware information.\nThis process is primarily used to detect and avoid virtualization and analysis environments.\n","references":["https://www.loobins.io/binaries/sysctl/#","https://evasions.checkpoint.com/techniques/macos.html","https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/","https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/","https://objective-see.org/blog/blog_0x1E.html","https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior","https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.stealth","attack.t1497.001","attack.discovery","attack.t1082"],"path":"rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml","techniques":["T1497.001","T1082"],"cves":[]},{"id":"7124aebe-4cd7-4ccb-8df0-6d6b93c96795","title":"Suspicious Kernel Dump Using Dtrace","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-12-28","modified":null,"description":"Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1","references":["https://twitter.com/0gtweet/status/1474899714290208777?s=12","https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump.yml","techniques":["T1082"],"cves":[]},{"id":"746c86fb-ccda-4816-8997-01386263acc4","title":"Container Residence Discovery Via Proc Virtual FS","author":"Seth Hanford","status":"test","level":"low","date":"2023-08-23","modified":null,"description":"Detects potential container discovery via listing of certain kernel features in the \"/proc\" virtual filesystem","references":["https://blog.skyplabs.net/posts/container-detection/","https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml","techniques":["T1082"],"cves":[]},{"id":"7be5fb68-f9ef-476d-8b51-0256ebece19e","title":"Suspicious Execution of Hostname","author":"frack113","status":"test","level":"low","date":"2022-01-01","modified":null,"description":"Use of hostname to get information","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-6---hostname-discovery-windows","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/hostname"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_hostname_execution.yml","techniques":["T1082"],"cves":[]},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"87cc6698-3e07-4ba2-9b43-a85a73e151e2","title":"Bitbucket User Permissions Export Attempt","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2024-02-25","modified":null,"description":"Detects user permission data export attempt.","references":["https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html","https://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html"],"logsource":{"product":"bitbucket","service":"audit"},"tags":["attack.reconnaissance","attack.collection","attack.discovery","attack.t1213","attack.t1082","attack.t1591.004"],"path":"rules/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml","techniques":["T1213","T1082","T1591.004"],"cves":[]},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","author":"Austin Clark","status":"test","level":"low","date":"2019-08-12","modified":"2023-01-04","description":"Find information about network devices that is not stored in config files","references":["https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.discovery","attack.t1083","attack.t1201","attack.t1057","attack.t1018","attack.t1082","attack.t1016","attack.t1049","attack.t1033","attack.t1124"],"path":"rules/network/cisco/aaa/cisco_cli_discovery.yml","techniques":["T1083","T1201","T1057","T1018","T1082","T1016","T1049","T1033","T1124"],"cves":[]},{"id":"98b53e78-ebaf-46f8-be06-421aafd176d9","title":"HackTool - winPEAS Execution","author":"Georg Lauenstein (sure[secure])","status":"test","level":"high","date":"2022-09-19","modified":"2023-03-23","description":"WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz","references":["https://github.com/carlospolop/PEASS-ng","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.discovery","attack.t1082","attack.t1087","attack.t1046"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml","techniques":["T1082","T1087","T1046"],"cves":[]},{"id":"9d5a1274-922a-49d0-87f3-8c653483b909","title":"Uncommon System Information Discovery Via Wmic.EXE","author":"TropChaud","status":"test","level":"medium","date":"2023-01-26","modified":"2023-12-19","description":"Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,\nincluding OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS,\nand GPU driver products/versions.\nSome of these commands were used by Aurora Stealer in late 2022/early 2023.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic","https://nwgat.ninja/getting-system-information-with-wmic-on-windows/","https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar","https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/","https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/","https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml","techniques":["T1082"],"cves":[]},{"id":"b207d563-a1d9-4275-b349-77d1eb55aa6d","title":"System Info Discovery via Sysinfo Syscall","author":"Milad Cheraghi","status":"experimental","level":"low","date":"2025-05-30","modified":"2025-12-05","description":"Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.\nMalware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.\n","references":["https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md","https://man7.org/linux/man-pages/man2/sysinfo.2.html"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.discovery","attack.t1057","attack.t1082"],"path":"rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml","techniques":["T1057","T1082"],"cves":[]},{"id":"c2c76b77-32be-4d1f-82c9-7e544bdfe0eb","title":"Potential Suspicious Activity Using SeCEdit","author":"Janantha Marasinghe","status":"test","level":"medium","date":"2022-11-18","modified":"2022-12-30","description":"Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy","references":["https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.discovery","attack.persistence","attack.credential-access","attack.privilege-escalation","attack.execution","attack.stealth","attack.defense-impairment","attack.t1685.001","attack.t1547.001","attack.t1505.005","attack.t1556.002","attack.t1685","attack.t1574.007","attack.t1564.002","attack.t1546.008","attack.t1546.007","attack.t1547.014","attack.t1547.010","attack.t1547.002","attack.t1557","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_secedit_execution.yml","techniques":["T1685.001","T1547.001","T1505.005","T1556.002","T1685","T1574.007","T1564.002","T1546.008","T1546.007","T1547.014","T1547.010","T1547.002","T1557","T1082"],"cves":[]},{"id":"c79da740-5030-45ec-a2e0-479e824a562c","title":"System Disk And Volume Reconnaissance Via Wmic.EXE","author":"Stephen Lincoln '@slincoln-aiq' (AttackIQ)","status":"test","level":"medium","date":"2024-02-02","modified":"2025-10-20","description":"An adversary might use WMI to discover information about the system, such as the volume name, size,\nfree space, and other disk information. This can be done using the 'wmic' command-line utility and has been\nobserved being used by threat actors such as Volt Typhoon.\n","references":["https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1047","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_volume.yml","techniques":["T1047","T1082"],"cves":[]},{"id":"d27ab432-2199-483f-a297-03633c05bae6","title":"OS Architecture Discovery Via Grep","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"low","date":"2023-06-02","modified":null,"description":"Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of \"uname\" or \"cat /proc/cpuinfo\"\n","references":["https://blogs.jpcert.or.jp/en/2023/05/gobrat.html","https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/","https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection","https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml","techniques":["T1082"],"cves":[]},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"d85ecdd7-b855-4e6e-af59-d9c78b5b861e","title":"System Information Discovery Via Wmic.EXE","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"low","date":"2023-12-19","modified":"2024-01-15","description":"Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,\nincluding OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS,\nand GPU driver products/versions.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic","https://nwgat.ninja/getting-system-information-with-wmic-on-windows/","https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar","https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/","https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/","https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1082","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_wmic_recon_system_info.yml","techniques":["T1082"],"cves":[]},{"id":"e34cfa0c-0a50-4210-9cb3-5632d08eb041","title":"Potential GobRAT File Discovery Via Grep","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"high","date":"2023-06-02","modified":null,"description":"Detects the use of grep to discover specific files created by the GobRAT malware","references":["https://blogs.jpcert.or.jp/en/2023/05/gobrat.html","https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection","https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml","techniques":["T1082"],"cves":[]},{"id":"e568650b-5dcd-4658-8f34-ded0b1e13992","title":"Potential Product Class Reconnaissance Via Wmic.EXE","author":"Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2023-02-14","modified":"2025-03-17","description":"Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products.\nAdversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.\nThis information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.\n","references":["https://github.com/albertzsigovits/malware-notes/blob/c820c7fea76cf76a861b28ebc77e06100e20ec29/Ransomware/Maze.md","https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1","https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.discovery","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml","techniques":["T1047","T1082"],"cves":[]},{"id":"e6313acd-208c-44fc-a0ff-db85d572e90e","title":"Network Reconnaissance Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-07","modified":null,"description":"Detects a set of suspicious network related commands often used in recon stages","references":["https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087","attack.t1082","car.2016-03-001"],"path":"rules/windows/process_creation/proc_creation_win_nslookup_domain_discovery.yml","techniques":["T1087","T1082"],"cves":[]},{"id":"f34047d9-20d3-4e8b-8672-0a35cc50dc71","title":"System Information Discovery - Auditd","author":"Pawel Mazur","status":"test","level":"low","date":"2021-09-03","modified":"2023-03-06","description":"Detects System Information Discovery commands","references":["https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.discovery","attack.t1082"],"path":"rules/linux/auditd/lnx_auditd_system_info_discovery.yml","techniques":["T1082"],"cves":[]},{"id":"f5240972-3938-4e56-8e4b-e33893176c1f","title":"Suspicious Query of MachineGUID","author":"frack113","status":"test","level":"low","date":"2022-01-01","modified":null,"description":"Use of reg to get MachineGuid information","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-8---windows-machineguid-discovery"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_reg_machineguid.yml","techniques":["T1082"],"cves":[]},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","status":"test","level":"high","date":"2022-10-10","modified":"2024-11-23","description":"Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff","references":["https://web.archive.org/web/20231210115125/http://www.xuetr.com/","https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/","https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1082","attack.t1057","attack.t1012","attack.t1083","attack.t1007"],"path":"rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","techniques":["T1082","T1057","T1012","T1083","T1007"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-23692","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-43770","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-34362","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40449","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-1653","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-8195","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-8196","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}