T1082 System Information Discovery

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. MITRE ATT&CK

5 programs on CmdID 26 Sigma rules T1082 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

cmd.exeits Sigma rules grepits Sigma rules reg.exeits Sigma rules sysctlits Sigma rules wmic.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highHackTool - PCHunter ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali · Windows

highHackTool - winPEAS ExecutionGeorg Lauenstein (sure[secure]) · Windows

highHackTool - WinPwn ExecutionSwachchhanda Shrawan Poudel · Windows

highNetwork Reconnaissance ActivityFlorian Roth (Nextron Systems) · Windows

highPotential GobRAT File Discovery Via GrepJoseliyo Sanchez, @Joseliyo_Jstnk · Linux

highSuspicious Kernel Dump Using DtraceFlorian Roth (Nextron Systems) · Windows

mediumPotential Product Class Reconnaissance Via Wmic.EXEMichael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe · Windows

mediumPUA - System Informer ExecutionFlorian Roth (Nextron Systems) · Windows

mediumSystem Disk And Volume Reconnaissance Via Wmic.EXEStephen Lincoln '@slincoln-aiq' (AttackIQ) · Windows

mediumSystem Information Discovery Using IoregJoseliyo Sanchez, @Joseliyo_Jstnk · macOS

mediumSystem Information Discovery Using sw_versJoseliyo Sanchez, @Joseliyo_Jstnk · macOS

mediumSystem Information Discovery Using System_ProfilerStephen Lincoln `@slincoln_aiq` (AttackIQ) · macOS

mediumSystem Information Discovery Via Sysctl - MacOSPratinav Chandra · macOS

mediumUncommon System Information Discovery Via Wmic.EXETropChaud · Windows

lowCMD Shell Output Redirectfrack113 · Windows

lowContainer Residence Discovery Via Proc Virtual FSSeth Hanford · Linux

lowDocker Container Discovery Via Dockerenv ListingSeth Hanford · Linux

lowOS Architecture Discovery Via GrepJoseliyo Sanchez, @Joseliyo_Jstnk · Linux

lowPotential Container Discovery Via Inodes ListingSeth Hanford · Linux

lowSuspicious Execution of Hostnamefrack113 · Windows

lowSuspicious Execution of Systeminfofrack113 · Windows

lowSuspicious Query of MachineGUIDfrack113 · Windows

lowSystem Information Discovery via Registry Querieslazarg · Windows

lowSystem Information Discovery Via Wmic.EXEJoseliyo Sanchez, @Joseliyo_Jstnk · Windows

informationalSystem Information DiscoveryÖmer Günal, oscd.community · Linux

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Show all DMI table contents on the page for dmidecode

sudo dmidecodeIdentify

Show the BIOS version on the page for dmidecode

sudo dmidecode --string bios-versionIdentify

Show the system's serial number on the page for dmidecode

sudo dmidecode --string system-serial-numberIdentify

To send the output of assoc to the file assoc.txt, type on the page for assoc

assoc>assoc.txtIdentify

To print a directory listing, type on the page for dir

dir > prnIdentify

You can also redirect output of the dir command to a file by replacing prn with a file name. You can also type a path. For example, to direct dir output to the file dir.doc in the Records directory, type on the page for dir

dir > \records\dir.docIdentify

Show current host name on the page for hostname

hostnameIdentify

Show the network address of the host name on the page for hostname

hostname --ip-addressIdentify

Show the FQDN (Fully Qualified Domain Name) on the page for hostname

hostname --fqdnIdentify

Set current host name on the page for hostname

hostname new_hostnameIdentify

Display information about all CPUs on the page for lscpu

lscpuIdentify

Display information in a table on the page for lscpu

lscpu --extendedIdentify

And 43 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1082: a Sigma rule it trips is tagged with it, or its abuse is documented as it.