systeminfo
Displays detailed configuration information about a computer and its operating system, including operating system configuration, security information, product ID, and hardware properties (such as RAM, disk space, and network cards). Windows commands reference
On Windows 11 Sigma rules name it File systeminfo.exe
Windows
systeminfo [/s <computer> [/u <domain>\<username> [/p <password>]]] [/fo {TABLE | LIST | CSV}] [/nh]To view configuration information for a computer named Srvmain, type
systeminfo /s srvmainIdentify/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands referenceTrips 1 Sigma rule: lowSuspicious Execution of Systeminfo by frack113
To remotely view configuration information for a computer named Srvmain2 that is located on the Maindom domain, type
systeminfo /s srvmain2 /u maindom\hiroplnIdentify/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands reference/uRuns the command with the account permissions of the specified user account. Windows commands referenceTrips 1 Sigma rule: lowSuspicious Execution of Systeminfo by frack113
To remotely view configuration information (in list format) for a computer named Srvmain2 that is located on the Maindom domain, type
systeminfo /s srvmain2 /u maindom\hiropln /p p@ssW23 /fo listIdentify/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands reference/uRuns the command with the account permissions of the specified user account. Windows commands reference/pSpecifies the password of the user account that is specified in the /u parameter. Windows commands reference/foSpecifies the output format with one of the following values: TABLE - Displays output in a table. Windows commands referenceTrips 1 Sigma rule: lowSuspicious Execution of Systeminfo by frack113
/s <computer>Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer./u <domain>\<username>Runs the command with the account permissions of the specified user account. If /u is not specified, this command uses the permissions of the user who is currently logged on to the computer that is issuing the command./p <password>Specifies the password of the user account that is specified in the /u parameter./fo <format>Specifies the output format with one of the following values:
- TABLE - Displays output in a table.
- LIST - Displays output in a list.
- CSV - Displays output in comma-separated values (.csv) format./nhSuppresses column headers in the output. Valid when the /fo parameter is set to TABLE or CSV./?Displays help at the command prompt.Windows
Display operating system configuration for a local or remote machine.
Display system configuration for the local machine
systeminfoIdentifyTrips 1 Sigma rule: lowSuspicious Execution of Systeminfo by frack113
Display system configuration in a specified output format
systeminfo /fo tableIdentify/foSpecifies the output format with one of the following values: TABLE - Displays output in a table. Windows commands referenceTrips 1 Sigma rule: lowSuspicious Execution of Systeminfo by frack113
Display system configuration for a remote machine
systeminfo /s remote_name /u username /p passwordIdentify/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands reference/uRuns the command with the account permissions of the specified user account. Windows commands reference/pSpecifies the password of the user account that is specified in the /u parameter. Windows commands referenceTrips 1 Sigma rule: lowSuspicious Execution of Systeminfo by frack113
Display help
systeminfo /?Identify/?Displays help at the command prompt. Windows commands referenceTrips 1 Sigma rule: lowSuspicious Execution of Systeminfo by frack113