Gather Victim Host Information T1592
Tactic: Reconnaissance
Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).
Events covered
4 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| Sysmon-for-Linux | Event ID 1 | Process Create |
Authoring guide
These 13 rules share fields, values, and exclusions.
Fields filtered most (10 distinct)
These fields appear most often in rule filters.
Top indicator values (54 distinct)
These values appear most often in rule predicates.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 3 rules
Splunk 6 rules
- Recon AVProduct Through Pwh or WMI
- Recon Using WMI Class
- System Info Gathering Using Dxdiag Application
- Windows Gather Victim Host Information Camera
- Windows WinPEAS PowerShell Script Execution
- WMI Recon Running Process Or Services