System Information Discovery T1082

Events covered

14 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 158 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (94 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (1222 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (331 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 34 rules

• Audit policy enumerated
• Bitbucket User Details Export Attempt Detected
• Bitbucket User Permissions Export Attempt
• Cisco Discovery
• CMD Shell Output Redirect
• Container Residence Discovery Via Proc Virtual FS
• Docker Container Discovery Via Dockerenv Listing
• HackTool - PCHunter Execution
• HackTool - winPEAS Execution
• HackTool - WinPwn Execution
• HackTool - WinPwn Execution - ScriptBlock
• Network Reconnaissance Activity
• OS Architecture Discovery Via Grep
• Potential Container Discovery Via Inodes Listing
• Potential GobRAT File Discovery Via Grep
• Potential Product Class Reconnaissance Via Wmic.EXE
• Potential Suspicious Activity Using SeCEdit
• PUA - System Informer Execution
• Suspicious Execution of Hostname
• Suspicious Execution of Systeminfo
• Suspicious Kernel Dump Using Dtrace
• Suspicious Query of MachineGUID
• System and Hardware Information Discovery
• System Disk And Volume Reconnaissance Via Wmic.EXE
• System Info Discovery via Sysinfo Syscall
• System Information Discovery
• System Information Discovery - Auditd
• System Information Discovery Using Ioreg
• System Information Discovery Using sw_vers
• System Information Discovery Using System_Profiler
• System Information Discovery via Registry Queries
• System Information Discovery Via Sysctl - MacOS
• System Information Discovery Via Wmic.EXE
• Uncommon System Information Discovery Via Wmic.EXE

Elastic 46 rules

• Deprecated - PowerShell Script with Discovery Capabilities
• Discovery Command Output Written to Suspicious File
• Entra ID Sign-in BloodHound Suite User-Agent Detected
• Entra ID Sign-in TeamFiltration User-Agent Detected
• Enumeration Command Spawned via WMIPrvSE
• Enumeration of Kernel Modules via Proc
• Environment Variable Enumeration Detected via Defend for Containers
• Hping Process Activity
• Interactive Privilege Boundary Enumeration Detected via Defend for Containers
• Kernel Instrumentation Discovery via kprobes and tracefs
• Kernel Seeking Activity
• Kernel Unpacking Activity
• Linux System Information Discovery
• Linux System Information Discovery via Getconf
• Manual Mount Discovery via /etc/exports or /etc/fstab
• Passwordless Sudo Probing
• Pluggable Authentication Module (PAM) Version Discovery
• Polkit Version Discovery
• Potential Linux Hack Tool Launched
• Potential Meterpreter Reverse Shell
• PowerShell Suspicious Discovery Related Windows API Functions
• Service Account Namespace Read Detected via Defend for Containers
• Suspicious Instance Metadata Service (IMDS) API Command Line Execution
• Suspicious Instance Metadata Service (IMDS) API Request
• Suspicious JetBrains TeamCity Child Process
• Suspicious Kernel Feature Activity
• Suspicious Modprobe File Event
• Suspicious MS Office Child Process
• Suspicious PDF Reader Child Process
• Suspicious Proc Pseudo File System Enumeration
• Suspicious React Server Child Process
• Suspicious SIP Check by macOS Application
• Suspicious Sysctl File Event
• Suspicious System Commands Executed by Previously Unknown Executable
• Suspicious which Enumeration
• System and Network Configuration Check
• System Information Discovery via dmidecode from Parent Shell
• System Information Discovery via Windows Command Shell
• Unusual Kernel Module Enumeration
• Unusual Linux System Information Discovery Activity
• Virtual Machine Fingerprinting
• Virtual Machine Fingerprinting via Grep
• Windows System Information Discovery
• Windows System Network Connections Discovery
• Wireless Credential Dumping using Netsh Command
• Yum/DNF Plugin Status Discovery

Splunk 42 rules

• Cisco ASA - Reconnaissance Command Activity
• Cisco IOS XE Reconnaissance Command Activity
• Common Recon Commands in Short Burst (Sysmon)
• Common Recon Commands in Short Burst (Windows Event Log)
• Common Reconnaissance Commands (PowerShell)
• Common Reconnaissance Commands (Sysmon)
• Common Reconnaissance Commands (Windows Event Log)
• Detect attackers scanning for vulnerable JBoss servers
• ESXi System Information Discovery
• Event Logs Queried for RDP Sessions (PowerShell)
• Event Logs Queried for RDP Sessions (Sysmon)
• Event Logs Queried for RDP Sessions (Windows Event Log)
• IcedID Discovery Commands (EDR)
• IcedID Discovery Commands (Sysmon)
• IcedID Discovery Commands (Windows Event Log)
• Linux Auditd Kernel Module Enumeration
• Linux Kernel Module Enumeration
• Potential PowerShell Post-Exploitation Activity (Sysmon)
• Potential PowerShell Post-Exploitation Activity (Windows Event Log)
• Potential Target Discovery via PowerShell Event Log Queries (PowerShell)
• SharpHound Enumeration (Windows Event Log)
• SharpHound Keywords (PowerShell)
• System Enumeration with WMIC (Sysmon)
• System Enumeration with WMIC (Windows Event Log)
• System Information Discovery - Windows (PowerShell)
• System Information Discovery - Windows (Sysmon)
• System Information Discovery - Windows (Windows Event Log)
• System Information Discovery Detection
• Web Servers Executing Suspicious Processes
• Windows Information Discovery Fsutil
• Windows Post Exploitation Risk Behavior
• Windows PowerShell Invoke-RestMethod IP Information Collection
• Windows PsTools Recon Usage
• Windows WinPEAS PowerShell Script Execution
• Windows Wmic CPU Discovery
• Windows Wmic DiskDrive Discovery
• Windows Wmic Memory Chip Discovery
• Windows Wmic Network Discovery
• Windows Wmic Systeminfo Discovery
• WMIC Host Reconniassance (PowerShell)
• WMIC Host Reconniassance (Sysmon)
• WMIC Host Reconniassance (Windows Event Log)

Kusto 33 rules

• Azure Security Benchmark Posture Changed
• CDM_ContinuousDiagnostics&Mitigation_PostureChanged
• Claroty - New Asset
• CMMC 2.0 Level 1 (Foundational) Readiness Posture
• CMMC 2.0 Level 2 (Advanced) Readiness Posture
• Datawiza - massive errors detected
• Detect Suspicious Commands Initiated by Webserver Processes
• M2131_AssetStoppedLogging
• M2131_DataConnectorAddedChangedRemoved
• M2131_EventLogManagementPostureChanged_EL0
• M2131_EventLogManagementPostureChanged_EL1
• M2131_EventLogManagementPostureChanged_EL2
• M2131_EventLogManagementPostureChanged_EL3
• M2131_LogRetentionLessThan1Year
• M2131_RecommendedDatatableUnhealthy
• NIST SP 800-53 Posture Changed
• Pathlock TDnR - ABAP Runtime Dumps
• Pathlock TDnR - Database Cockpit Audit Events
• Pathlock TDnR - J2EE Security Audit Events
• Pathlock TDnR - J2EE Security Events
• Pathlock TDnR - Missing SAP Security Notes
• Pathlock TDnR - Pathlock Security Radar Internal Events
• Pathlock TDnR - RiskTrack Audit Results
• Pathlock TDnR - SAP BTP Cloud Foundry Events
• Pathlock TDnR - SAP HANA Database Audit Trail
• Pathlock TDnR - SAP Public Cloud Security Audit Events
• Pathlock TDnR - SAP Security Audit Log Events
• Pathlock TDnR - SAP System Log Events
• Pathlock TDnR - Transaction and Report Statistics
• Powershell Empire Cmdlets Executed in Command Line
• Snowflake - Multiple failed queries
• Votiro - File Blocked from Connector
• ZeroTrust(TIC3.0) Control Assessment Posture Change

YARA-L 3 rules

• Hacktool - WinPEAS Execution Patterns
• Recon Environment Enumeration System CISA Report
• sap gateway ufo table access