System Information Discovery T1082
Tactic: Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Events covered
20 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 4799 | A security-enabled local group membership was enumerated. |
| Defender-DeviceProcessEvents | any | Process activity |
| ESF | exec | Process Execution |
| ESF | fork | Process Fork |
| ESF | open | File Open |
| ESF | write | File Write |
| Linux-Auditd | Event ID 1101 | USER_ACCT |
| Linux-Auditd | Event ID 1103 | CRED_ACQ |
| Linux-Auditd | Event ID 1105 | USER_START |
| Linux-Auditd | Event ID 1106 | USER_END |
| Linux-Auditd | Event ID 1123 | USER_CMD |
| Linux-Auditd | Event ID 1300 | SYSCALL |
| Linux-Auditd | Event ID 1302 | PATH |
| Linux-Auditd | Event ID 1309 | EXECVE |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| Sysmon-for-Linux | Event ID 1 | Process Create |
Authoring guide
These 169 rules share fields, values, and exclusions.
Fields filtered most (95 distinct)
These fields appear most often in rule filters.
Top indicator values (1502 distinct)
These values appear most often in rule predicates.
Exclusions (431 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 34 rules
- Audit policy enumerated
- Bitbucket User Details Export Attempt Detected
- Bitbucket User Permissions Export Attempt
- Cisco Discovery
- CMD Shell Output Redirect
- Container Residence Discovery Via Proc Virtual FS
- Docker Container Discovery Via Dockerenv Listing
- HackTool - PCHunter Execution
- HackTool - winPEAS Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- Network Reconnaissance Activity
- OS Architecture Discovery Via Grep
- Potential Container Discovery Via Inodes Listing
- Potential GobRAT File Discovery Via Grep
- Potential Product Class Reconnaissance Via Wmic.EXE
- Potential Suspicious Activity Using SeCEdit
- PUA - System Informer Execution
- Suspicious Execution of Hostname
- Suspicious Execution of Systeminfo
- Suspicious Kernel Dump Using Dtrace
- Suspicious Query of MachineGUID
- System and Hardware Information Discovery
- System Disk And Volume Reconnaissance Via Wmic.EXE
- System Info Discovery via Sysinfo Syscall
- System Information Discovery
- System Information Discovery - Auditd
- System Information Discovery Using Ioreg
- System Information Discovery Using sw_vers
- System Information Discovery Using System_Profiler
- System Information Discovery via Registry Queries
- System Information Discovery Via Sysctl - MacOS
- System Information Discovery Via Wmic.EXE
- Uncommon System Information Discovery Via Wmic.EXE
Elastic 57 rules
- Azure WireServer HTTP Request from Unexpected User Agent
- Azure WireServer Unusual Process Connection
- Deprecated - PowerShell Script with Discovery Capabilities
- Discovery Command Output Written to Suspicious File
- Domain Computers Enumeration via LDAP Search
- Entra ID Sign-in BloodHound Suite User-Agent Detected
- Entra ID Sign-in TeamFiltration User-Agent Detected
- Enumeration Command Spawned via WMIPrvSE
- Enumeration of Kernel Modules via Proc
- Environment Variable Enumeration Detected via Defend for Containers
- Hping Process Activity
- Initial Access via macOS Installer Package
- Kerberos Config File Accessed by Osascript
- Kernel Instrumentation Discovery via kprobes and tracefs
- Kernel Seeking Activity
- Kernel Unpacking Activity
- Linux System Information Discovery
- Linux System Information Discovery via Getconf
- Manual Mount Discovery via /etc/exports or /etc/fstab
- Multi-Value Secret Searching via Find
- Multi-Value Secret Searching via Grep
- Passwordless Sudo Probing
- Pluggable Authentication Module (PAM) Version Discovery
- Polkit Version Discovery
- Potential Linux Hack Tool Launched
- Potential Meterpreter Reverse Shell
- Potential Virtual Machine Fingerprinting via VMDetect
- PowerShell Suspicious Discovery Related Windows API Functions
- Privilege Boundary Enumeration Detected via Defend for Containers
- Service Account Namespace Read Detected via Defend for Containers
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious Instance Metadata Service (IMDS) API Request
- Suspicious JetBrains TeamCity Child Process
- Suspicious Kernel Feature Activity
- Suspicious Modprobe File Event
- Suspicious MS Office Child Process
- Suspicious PDF Reader Child Process
- Suspicious Proc Pseudo File System Enumeration
- Suspicious React Server Child Process
- Suspicious SIP Check by macOS Application
- Suspicious Sysctl File Event
- Suspicious System Commands Executed by Previously Unknown Executable
- Suspicious which Enumeration
- System and Network Configuration Check
- System Information Discovery via dmidecode from Parent Shell
- System Information Discovery via Windows Command Shell
- System Reconnaissance from Unsigned Parent Followed by Network Connection
- Unusual Kernel Module Enumeration
- Unusual Linux System Information Discovery Activity
- User TCC DB Access by Osascript
- User TCC DB Access by Unsigned or Untrusted Process
- Virtual Machine Fingerprinting
- Virtual Machine Fingerprinting via Grep
- Windows System Information Discovery
- Windows System Network Connections Discovery
- Wireless Credential Dumping using Netsh Command
- Yum/DNF Plugin Status Discovery
Splunk 42 rules
- Cisco ASA - Reconnaissance Command Activity
- Cisco IOS XE Reconnaissance Command Activity
- Common Recon Commands in Short Burst (Sysmon)
- Common Recon Commands in Short Burst (Windows Event Log)
- Common Reconnaissance Commands (PowerShell)
- Common Reconnaissance Commands (Sysmon)
- Common Reconnaissance Commands (Windows Event Log)
- Detect attackers scanning for vulnerable JBoss servers
- ESXi System Information Discovery
- Event Logs Queried for RDP Sessions (PowerShell)
- Event Logs Queried for RDP Sessions (Sysmon)
- Event Logs Queried for RDP Sessions (Windows Event Log)
- IcedID Discovery Commands (Sysmon)
- IcedID Discovery Commands (Windows Event Log)
- Linux Auditd Kernel Module Enumeration
- Linux Enumeration Techniques
- Linux Kernel Module Enumeration
- Potential PowerShell Post-Exploitation Activity (Sysmon)
- Potential PowerShell Post-Exploitation Activity (Windows Event Log)
- Potential Target Discovery via PowerShell Event Log Queries (PowerShell)
- SharpHound Enumeration (Windows Event Log)
- SharpHound Keywords (PowerShell)
- System Enumeration with WMIC (Sysmon)
- System Enumeration with WMIC (Windows Event Log)
- System Information Discovery - Windows (PowerShell)
- System Information Discovery - Windows (Sysmon)
- System Information Discovery - Windows (Windows Event Log)
- System Information Discovery Detection
- Web Servers Executing Suspicious Processes
- Windows Information Discovery Fsutil
- Windows Post Exploitation Risk Behavior
- Windows PowerShell Invoke-RestMethod IP Information Collection
- Windows PsTools Recon Usage
- Windows WinPEAS PowerShell Script Execution
- Windows Wmic CPU Discovery
- Windows Wmic DiskDrive Discovery
- Windows Wmic Memory Chip Discovery
- Windows Wmic Network Discovery
- Windows Wmic Systeminfo Discovery
- WMIC Host Reconniassance (PowerShell)
- WMIC Host Reconniassance (Sysmon)
- WMIC Host Reconniassance (Windows Event Log)
Kusto 33 rules
- Azure Security Benchmark Posture Changed
- CDM_ContinuousDiagnostics&Mitigation_PostureChanged
- Claroty - New Asset
- CMMC 2.0 Level 1 (Foundational) Readiness Posture
- CMMC 2.0 Level 2 (Advanced) Readiness Posture
- Datawiza - massive errors detected
- Detect Suspicious Commands Initiated by Webserver Processes
- M2131_AssetStoppedLogging
- M2131_DataConnectorAddedChangedRemoved
- M2131_EventLogManagementPostureChanged_EL0
- M2131_EventLogManagementPostureChanged_EL1
- M2131_EventLogManagementPostureChanged_EL2
- M2131_EventLogManagementPostureChanged_EL3
- M2131_LogRetentionLessThan1Year
- M2131_RecommendedDatatableUnhealthy
- NIST SP 800-53 Posture Changed
- Pathlock TDnR - ABAP Runtime Dumps
- Pathlock TDnR - Database Cockpit Audit Events
- Pathlock TDnR - J2EE Security Audit Events
- Pathlock TDnR - J2EE Security Events
- Pathlock TDnR - Missing SAP Security Notes
- Pathlock TDnR - Pathlock Security Radar Internal Events
- Pathlock TDnR - RiskTrack Audit Results
- Pathlock TDnR - SAP BTP Cloud Foundry Events
- Pathlock TDnR - SAP HANA Database Audit Trail
- Pathlock TDnR - SAP Public Cloud Security Audit Events
- Pathlock TDnR - SAP Security Audit Log Events
- Pathlock TDnR - SAP System Log Events
- Pathlock TDnR - Transaction and Report Statistics
- Powershell Empire Cmdlets Executed in Command Line
- Snowflake - Multiple failed queries
- Votiro - File Blocked from Connector
- ZeroTrust(TIC3.0) Control Assessment Posture Change