T1082

System Information Discovery

Discovery Last updated:

Adversaries may attempt to gather detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Tools such as systeminfo, wmic, ver, and uname can be used to enumerate this data. Adversaries use this information to shape follow-on behaviors, including payload targeting, privilege escalation path selection, and evasion tuning. On ESXi, esxcli utilities expose system version and hostname. In cloud IaaS environments, authenticated API calls can return OS platform and instance metadata. This technique is frequently observed early in post-exploitation chains as part of host fingerprinting.

What is T1082 System Information Discovery?

System Information Discovery (T1082) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for System Information Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated low severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1082 System Information Discovery
Canonical reference
https://attack.mitre.org/techniques/T1082/
Microsoft Sentinel / Defender
kusto 
let SysInfoTools = dynamic(["systeminfo.exe", "msinfo32.exe"]);
let WmicSysPatterns = dynamic(["os get", "computersystem get", "bios get", "cpu get", "memorychip get", "csproduct get"]);
let RegVersionPaths = dynamic(["CurrentVersion", "CurrentBuildNumber", "ProductName", "ReleaseId", "DisplayVersion"]);
let PSInfoPatterns = dynamic(["Get-ComputerInfo", "Get-WmiObject Win32_OperatingSystem", "Get-CimInstance Win32_OperatingSystem", "[System.Environment]::OSVersion", "$env:OS", "gwmi Win32_OS"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    FileName in~ (SysInfoTools)
    or (FileName =~ "wmic.exe" and ProcessCommandLine has_any (WmicSysPatterns))
    or (FileName =~ "reg.exe" and ProcessCommandLine has_any (RegVersionPaths) and ProcessCommandLine has "query")
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any (PSPatterns))
    or (FileName =~ "cmd.exe" and ProcessCommandLine has "ver")
)
| extend IsSystemInfo = FileName in~ (SysInfoTools)
| extend IsWmicOsEnum = FileName =~ "wmic.exe" and ProcessCommandLine has_any (WmicSysPatterns)
| extend IsRegQuery = FileName =~ "reg.exe" and ProcessCommandLine has_any (RegVersionPaths)
| extend IsPSEnum = FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any (PSInfoPatterns)
| extend SuspiciousParent = InitiatingProcessFileName in~ ("cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "svchost.exe", "services.exe")
| extend OfficeParent = InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "mspub.exe")
| where IsSystemInfo or IsWmicOsEnum or IsRegQuery or IsPSEnum
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         IsSystemInfo, IsWmicOsEnum, IsRegQuery, IsPSEnum,
         SuspiciousParent, OfficeParent
| sort by Timestamp desc

Detects system information discovery commands using Microsoft Defender for Endpoint DeviceProcessEvents. Monitors for systeminfo.exe, msinfo32.exe, wmic OS/hardware enumeration, registry queries for Windows version keys, and PowerShell cmdlets that retrieve OS/hardware details. Tags suspicious parent processes (LOLBins, Office apps) to help triage automated discovery versus post-exploitation reconnaissance.

low severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • IT operations scripts and monitoring agents (Zabbix, SolarWinds, SCCM inventory) that routinely collect system information
  • Software installers checking OS version compatibility before installing packages
  • Help desk and remote support tools that gather system information for troubleshooting tickets
  • Vulnerability scanners and compliance auditing tools (Tenable, Qualys, CrowdStrike Spotlight) enumerating host details
  • Developer workstations where engineers query system info for build environment validation

Sigma rule & cross-platform mapping

The detection logic for System Information Discovery (T1082) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1082 Sigma rules on detection.fyi

Platform-specific guides for T1082

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (7)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1System Information Enumeration via systeminfo.exe

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\systeminfo.exe, CommandLine containing redirect to temp file. Sysmon Event ID 11: File Create event for %TEMP%\sysinfo_out.txt. Security Event ID 4688 if command line auditing enabled.

  2. Test 2WMI OS and Hardware Discovery via wmic.exe

    Expected signal: Sysmon Event ID 1: Four separate Process Create events for wmic.exe, each with distinct CommandLine arguments containing 'os get', 'computersystem get', 'bios get', 'cpu get'. Multiple rapid wmic executions from the same parent within seconds is particularly notable.

  3. Test 3PowerShell WMI-based System Profiling

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-CimInstance Win32_OperatingSystem' and 'Win32_ComputerSystem'. PowerShell ScriptBlock Log Event ID 4104 (Microsoft-Windows-PowerShell/Operational) with full script content showing WMI class queries.

  4. Test 4Registry Query for Windows Version Information

    Expected signal: Sysmon Event ID 1: Three Process Create events for reg.exe, each querying HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion for different value names. Sysmon Event ID 13 (Registry Value Set) is NOT generated because these are read operations; detection relies on process creation with reg.exe command line analysis.

  5. Test 5Linux System Information Discovery via uname and /etc/os-release

    Expected signal: Linux auditd syscall records for execve of /usr/bin/uname, /bin/cat with arguments /etc/os-release and /proc/version, /usr/bin/hostnamectl, /usr/bin/lscpu. Syslog entries if process accounting is enabled. In cloud environments, these commands may appear in CloudTrail/GCP audit logs if executed via SSM Session Manager or similar.

Response Playbook

Triage

  1. Identify the parent process — was systeminfo/wmic spawned by a scripting engine (wscript.exe, cscript.exe, mshta.exe), an Office application, or a non-administrative user account? Legitimate tools typically run from service accounts or under SCCM/monitoring agent parent processes.
  2. Check the user context — is this a privileged account, service account, or a standard user who would not normally run system enumeration commands? Standard end-users running systeminfo.exe from a non-admin shell is unusual.
  3. Look at timing and frequency — a single systeminfo.exe run is low signal. Multiple discovery commands (systeminfo, whoami, ipconfig, net user, net group) executed within a 5–15 minute window from the same process tree is high-fidelity post-exploitation behavior.
  4. Review what ran immediately before and after — did an untrusted binary, script, or document trigger this? Check parent process chain back to the originating process. If there is a phishing document, download, or lateral movement event in the preceding 30 minutes, escalate.
  5. Check network activity from the same process or session — system information is commonly exfiltrated immediately after collection. Look for outbound connections from the collecting process or its parent within 60 seconds of the discovery event.
  6. Assess whether this is part of a known baseline — check SCCM inventory schedules, vulnerability scanner scan windows, and software deployment jobs. Many environments have scheduled systeminfo collection from known service accounts at predictable times.

Containment

  1. If system discovery is confirmed as post-exploitation reconnaissance: isolate the endpoint immediately using EDR network isolation to prevent further lateral movement or data exfiltration.
  2. If a compromised user account is identified: disable the account in Active Directory, revoke active NTLM/Kerberos sessions (klist purge on the host if accessible), and reset the password.
  3. If the discovery was triggered by a malicious document or script: quarantine the file, block the delivery mechanism (email sender, URL, share path), and scan all endpoints that received the same file.
  4. If lateral movement indicators are present: identify all hosts the compromised account or credential has authenticated to in the preceding 24 hours using logon event correlation, and place each under enhanced monitoring.
  5. Preserve volatile state before any remediation: take a memory dump and disk snapshot of the affected host if forensic investigation is warranted.

Evidence Collection

  1. Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing enabled) showing the full command line of the discovery tools and their parent process chains.
  2. Network Connection Events — Sysmon Event ID 3 for any outbound connections made by the discovery process or its descendants, particularly to external or C2 infrastructure.
  3. File Creation Events — Sysmon Event ID 11 for any output files written by the discovery commands (e.g., systeminfo > C:\Users\Public\info.txt).
  4. PowerShell ScriptBlock Logging — Event ID 4104 in Microsoft-Windows-PowerShell/Operational if PowerShell was used for WMI-based discovery.
  5. Security Audit Logs — Event ID 4688 in the Security event log for process creation if Sysmon is not deployed; requires 'Audit Process Creation' and 'Include command line in process creation events' GPO settings.
  6. Prefetch Files — C:\Windows\Prefetch\SYSTEMINFO.EXE-*.pf and WMIC.EXE-*.pf provide execution timestamps and loaded modules to establish a timeline.
  7. Windows Registry — HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache (Shimcache) and HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Amcache.hve confirm binary execution history.
  8. EDR Process Tree — Full parent-child process chain from the EDR console showing the complete execution lineage from the initial access vector through discovery.

Escalation Criteria

  • ! System discovery commands spawned from a phishing document parent process (winword.exe, excel.exe, outlook.exe) — this is a near-certain indicator of successful initial access exploitation.
  • ! Multiple discovery commands executed in rapid succession from the same session: systeminfo + whoami + ipconfig + net user/group within a 10-minute window — classic adversary host fingerprinting pattern.
  • ! Discovery tool output redirected to a file in a world-writable directory (C:\Users\Public\, C:\ProgramData\, %TEMP%) suggesting preparation for exfiltration.
  • ! Outbound network connection to a public IP made by the same process or child process within 60 seconds of the discovery command — indicates automated C2 check-in or direct data exfiltration.
  • ! System discovery executed under a service account or SYSTEM context from an interactive session — service accounts should not be running interactive commands.
  • ! Discovery commands on a server (domain controller, file server, Exchange) rather than a workstation — the stakes are significantly higher for lateral movement and credential access.

Investigation Guide

Forensic Artifacts

  • > Prefetch: C:\Windows\Prefetch\SYSTEMINFO.EXE-*.pf — execution timestamps and loaded DLL list
  • > Prefetch: C:\Windows\Prefetch\WMIC.EXE-*.pf — confirms wmic execution and timing
  • > Shimcache: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache — last execution timestamp for systeminfo.exe, wmic.exe
  • > Amcache: C:\Windows\AppCompat\Programs\Amcache.hve — SHA1 hash and first execution timestamp of discovery binaries
  • > Event Log: Security Event ID 4688 (Process Creation) with command line, if GPO 'Include command line in process creation events' is enabled
  • > Event Log: Microsoft-Windows-PowerShell/Operational Event ID 4104 (ScriptBlock) if PowerShell-based WMI discovery was used
  • > File System: Any output files created by discovery commands (grep for systeminfo output patterns in temp and public directories)
  • > Windows Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — recent Run dialog entries if discovery was launched interactively
  • > Memory: Running process list and command line arguments if the system is still live — use EDR or ProcDump to capture process context

Tuning Guidance

T1082 detections are inherently noisy because systeminfo.exe and wmic are used by many legitimate IT operations tools. The most effective approach is context layering: a single systeminfo.exe execution from SCCM's ccmexec.exe parent is near-zero risk, while the same command from a wscript.exe parent immediately after a phishing email arrived is critical. Build an allowlist of known-good parent processes and service accounts that run scheduled inventory: SCCM/Intune (ccmexec.exe, msiexec.exe), monitoring agents (datadog-agent.exe, SolarWinds MTA), and vulnerability scanners (nessus, qualys). Suppress these from the base detection and rely on hunting queries for the residual volume. For environments with low PowerShell maturity, the Get-ComputerInfo and Win32_OperatingSystem WMI patterns produce the cleanest signal with fewer false positives than the binary-based detection. Raise alert severity dynamically when multiple discovery techniques (T1082 + T1033 + T1016 + T1049) fire from the same device within 15 minutes — this multi-technique clustering is one of the strongest available indicators of active post-exploitation reconnaissance.

Hunting Queries

Hunt for hosts or users executing multiple system discovery tools within 15-minute windows. Legitimate inventory tools rarely fire systeminfo and wmic together multiple times in rapid succession; this pattern is characteristic of automated post-exploitation frameworks (Cobalt Strike, Metasploit, Empire) running their default discovery modules.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("systeminfo.exe", "msinfo32.exe", "wmic.exe")
| summarize DiscoveryCount=count(), Commands=make_set(ProcessCommandLine), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 15m)
| where DiscoveryCount >= 3
| sort by DiscoveryCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\systeminfo.exe" OR Image="*\\msinfo32.exe" OR Image="*\\wmic.exe")
| bin _time span=15m
| stats count as DiscoveryCount, values(CommandLine) as Commands, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, User, ParentImage, _time
| where DiscoveryCount >= 3
| sort - DiscoveryCount

Hunt for system discovery tools with Office application or LOLBin grandparent processes. This two-hop parent chain (Office/LOLBin → shell → systeminfo) strongly indicates a macro or script executing post-exploitation reconnaissance following initial access via phishing or exploitation.

Hunting — KQL
kql 
let DiscoveryTools = dynamic(["systeminfo.exe", "wmic.exe", "msinfo32.exe", "reg.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (DiscoveryTools)
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
    | project ParentTimestamp=Timestamp, DeviceName, ParentAccountName=AccountName, ParentCmdLine=ProcessCommandLine, ParentPID=ProcessId, GrandparentFileName=InitiatingProcessFileName
) on DeviceName, $left.InitiatingProcessId == $right.ParentPID
| where GrandparentFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, GrandparentFileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\systeminfo.exe" OR Image="*\\wmic.exe" OR Image="*\\msinfo32.exe")
  (GrandparentImage="*\\winword.exe" OR GrandparentImage="*\\excel.exe" OR GrandparentImage="*\\outlook.exe" OR GrandparentImage="*\\mshta.exe" OR GrandparentImage="*\\wscript.exe" OR GrandparentImage="*\\cscript.exe" OR GrandparentImage="*\\rundll32.exe")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, GrandparentImage
| sort - _time

Hunt for system discovery events followed by outbound public network connections within 120 seconds. This correlation pattern identifies malware that collects system fingerprinting data and immediately beacons it back to a C2 server — a common behavior in RATs, stealers (TrickBot, DarkGate), and post-exploitation frameworks.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("systeminfo.exe", "wmic.exe", "msinfo32.exe")
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteIPType == "Public"
    | project NetTimestamp=Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessId
) on DeviceName
| where abs(datetime_diff('second', Timestamp, NetTimestamp)) < 120
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, RemoteIP, RemotePort, NetTimestamp
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\systeminfo.exe" OR Image="*\\wmic.exe" OR Image="*\\msinfo32.exe")
| eval discovery_time=_time
| join host [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
      NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
    | eval net_time=_time
    | table host, net_time, DestinationIp, DestinationPort, Image
]
| eval time_delta=abs(discovery_time - net_time)
| where time_delta < 120
| table _time, host, User, Image, CommandLine, DestinationIp, DestinationPort, time_delta
| sort - _time

Atomic Red Team Tests

Test 1 System Information Enumeration via systeminfo.exe
windows

Executes the built-in Windows systeminfo.exe utility to collect detailed OS version, hotfix list, hardware configuration, and network adapter information. This is the most commonly observed system discovery method across threat actor groups including TrickBot, Bumblebee, and SYSCON. Output is redirected to a temp file to simulate quiet data collection prior to exfiltration.

Command

powershell 
systeminfo > %TEMP%\sysinfo_out.txt & type %TEMP%\sysinfo_out.txt

Cleanup

powershell 
del %TEMP%\sysinfo_out.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\systeminfo.exe, CommandLine containing redirect to temp file. Sysmon Event ID 11: File Create event for %TEMP%\sysinfo_out.txt. Security Event ID 4688 if command line auditing enabled.

Expected Detection

KQL: IsSystemInfo=true, FileName=systeminfo.exe. SPL: IsSystemInfo=1. Parent process will be cmd.exe which is a moderate-risk parent. Alert fires on IsSystemInfo flag; severity raised if OfficeParent or SuspiciousParent flags are set.

Test 2 WMI OS and Hardware Discovery via wmic.exe
windows

Uses wmic.exe to query multiple hardware and OS properties in rapid succession — OS caption/version, BIOS serial, CPU name, and computer system domain. This pattern mirrors automated reconnaissance seen in DarkGate, njRAT, and Koadic frameworks which use wmic for structured system profiling. Executed as a one-liner to simulate a script-driven discovery phase.

Command

powershell 
wmic os get Caption,Version,BuildNumber,ServicePackMajorVersion /format:list & wmic computersystem get Name,Domain,TotalPhysicalMemory,Manufacturer /format:list & wmic bios get SerialNumber,SMBIOSBIOSVersion /format:list & wmic cpu get Name,NumberOfCores /format:list

Expected Telemetry

Sysmon Event ID 1: Four separate Process Create events for wmic.exe, each with distinct CommandLine arguments containing 'os get', 'computersystem get', 'bios get', 'cpu get'. Multiple rapid wmic executions from the same parent within seconds is particularly notable.

Expected Detection

KQL: IsWmicOsEnum=true for each process create event. SPL: IsWmicOsEnum=1. The hunting query for multiple discovery tools in a 15-minute window will also fire (DiscoveryCount >= 3 from wmic invocations alone).

Test 3 PowerShell WMI-based System Profiling
windows

Uses PowerShell to query Win32_OperatingSystem and Win32_ComputerSystem WMI classes — the programmatic equivalent of systeminfo.exe. This method is preferred by malware authors because WMI queries return structured objects rather than text, making automated parsing trivial. GravityRAT, InvisibleFerret, and HexEval Loader all use similar WMI-based host fingerprinting.

Command

powershell 
powershell.exe -NoProfile -Command "$os = Get-CimInstance Win32_OperatingSystem; $cs = Get-CimInstance Win32_ComputerSystem; Write-Output "OS: $($os.Caption) $($os.Version) Build:$($os.BuildNumber)"; Write-Output "Host: $($cs.Name) Domain: $($cs.Domain) RAM: $($cs.TotalPhysicalMemory)""

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-CimInstance Win32_OperatingSystem' and 'Win32_ComputerSystem'. PowerShell ScriptBlock Log Event ID 4104 (Microsoft-Windows-PowerShell/Operational) with full script content showing WMI class queries.

Expected Detection

KQL: IsPSEnum=true matching 'Win32_OperatingSystem' pattern in ProcessCommandLine. SPL: IsPSEnum=1. The hunting query correlating discovery with network connections will catch subsequent C2 beacon if this is part of a malware chain.

Test 4 Registry Query for Windows Version Information
windows

Queries the Windows Registry CurrentVersion keys to extract OS build number, product name, and release ID. This is a stealthier alternative to systeminfo.exe that generates less obvious process telemetry and is used by malware authors who want to avoid detection from systeminfo-specific signatures. The queries target the exact keys commonly read by malware for OS version gating.

Command

powershell 
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName & reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber & reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion

Expected Telemetry

Sysmon Event ID 1: Three Process Create events for reg.exe, each querying HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion for different value names. Sysmon Event ID 13 (Registry Value Set) is NOT generated because these are read operations; detection relies on process creation with reg.exe command line analysis.

Expected Detection

KQL: IsRegQuery=true matching 'CurrentVersion' and 'query' in ProcessCommandLine for reg.exe. SPL: IsRegQuery=1. Note: this generates lower confidence hits as reg query is widely used; analyst should review parent process chain.

Test 5 Linux System Information Discovery via uname and /etc/os-release
linux

Collects system information on Linux using uname, /etc/os-release, and /proc/version — the standard methods used by malware targeting Linux endpoints, cloud instances, and containerized environments. InvisibleFerret's 'pay' module and TeamTNT cloud malware use these exact commands for host profiling before deploying platform-specific payloads.

Command

bash 
uname -a && cat /etc/os-release && cat /proc/version && hostnamectl && lscpu | grep -E 'Architecture|CPU|Model name'

Expected Telemetry

Linux auditd syscall records for execve of /usr/bin/uname, /bin/cat with arguments /etc/os-release and /proc/version, /usr/bin/hostnamectl, /usr/bin/lscpu. Syslog entries if process accounting is enabled. In cloud environments, these commands may appear in CloudTrail/GCP audit logs if executed via SSM Session Manager or similar.

Expected Detection

Auditd-sourced Splunk SPL query for execve syscalls with arguments matching 'uname', 'os-release', 'lscpu'. Cloud SIEM: AWS GuardDuty or GCP SCC may surface related findings if the session was established via suspicious authentication. Linux detection confidence is lower without Sysmon for Linux or auditd configured to capture process executions.

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1033System Owner/User DiscoveryT1016System Network Configuration DiscoveryT1049System Network Connections DiscoveryT1057Process DiscoveryT1007System Service DiscoveryT1087Account DiscoveryT1069Permission Groups DiscoveryT1518Software DiscoveryT1497.001System ChecksT1059.001PowerShell

Same Tactic: Discovery

Popular Detections