CmdID

CmdID / Rules / Windows

Suspicious Execution of Systeminfo

A Sigma rule for process creation on Windows, by frack113.

low 1 ATT&CK technique 3 programs it names 7 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it
detection:
  selection:
    - Image|endswith: '\systeminfo.exe'
    - OriginalFileName: 'sysinfo.exe'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by frack113, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

To view configuration information for a computer named Srvmain, type on the page for systeminfo

systeminfo /s srvmainIdentify

To remotely view configuration information for a computer named Srvmain2 that is located on the Maindom domain, type on the page for systeminfo

systeminfo /s srvmain2 /u maindom\hiroplnIdentify

To remotely view configuration information (in list format) for a computer named Srvmain2 that is located on the Maindom domain, type on the page for systeminfo

systeminfo /s srvmain2 /u maindom\hiropln /p p@ssW23 /fo listIdentify

Display system configuration for the local machine on the page for systeminfo

systeminfoIdentify

Display system configuration in a specified output format on the page for systeminfo

systeminfo /fo tableIdentify

Display system configuration for a remote machine on the page for systeminfo

systeminfo /s remote_name /u username /p passwordIdentify

Display help on the page for systeminfo

systeminfo /?Identify

Programs and files it names

their pages here
systeminfosysinfo.exesysteminfo.exe

ATT&CK

the techniques it is tagged with
T1082System Information Discovery

Other rules for T1082 System Information Discovery

OS Architecture Discovery Via Grep · Potential GobRAT File Discovery Via Grep · Container Residence Discovery Via Proc Virtual FS · Docker Container Discovery Via Dockerenv Listing · Potential Container Discovery Via Inodes Listing · System Information Discovery · System Information Discovery Using Ioreg · System Information Discovery Using sw_vers · System Information Discovery Via Sysctl - MacOS · System Information Discovery Using System_Profiler · CMD Shell Output Redirect · System Information Discovery via Registry Queries