Detect System Information Discovery in Google Chronicle

rule T1082_System_Information_Discovery {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects System Information Discovery via systeminfo, msinfo32, wmic OS/hardware enumeration, reg.exe version queries, and PowerShell WMI system fingerprinting (MITRE ATT&CK T1082)"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1082"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1082/"
    severity = "MEDIUM"
    confidence = "HIGH"
    platform = "Windows"
    created = "2026-04-13"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.metadata.product_name = /Windows/i
    (
      re.regex($e.target.process.file.full_path, `(?i)(\\systeminfo\.exe|\\msinfo32\.exe)$`)
      or (
        re.regex($e.target.process.file.full_path, `(?i)\\wmic\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(os\s+get|computersystem\s+get|bios\s+get|cpu\s+get|memorychip\s+get|csproduct\s+get)`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)\\reg\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)\bquery\b`) and
        re.regex($e.target.process.command_line, `(?i)(currentversion|currentbuildnumber|productname|releaseid|displayversion)`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)\\(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(get-computerinfo|win32_operatingsystem|win32_bios|win32_computersystem|osversion|\$env:os|gwmi\s+win32_os)`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)\\cmd\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)\bver\b`)
      )
    )

  outcome:
    $suspicious_parent = re.regex($e.principal.process.file.full_path, `(?i)(wscript|cscript|mshta|rundll32|regsvr32|svchost)\.exe$`)
    $office_parent = re.regex($e.principal.process.file.full_path, `(?i)(winword|excel|outlook|powerpnt|mspub)\.exe$`)
    $process_image = $e.target.process.file.full_path
    $command_line = $e.target.process.command_line
    $parent_image = $e.principal.process.file.full_path
    $hostname = $e.principal.hostname
    $username = $e.principal.user.userid

  condition:
    $e
}