Detect System Information Discovery in Elastic Security
Adversaries may attempt to gather detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Tools such as systeminfo, wmic, ver, and uname can be used to enumerate this data. Adversaries use this information to shape follow-on behaviors, including payload targeting, privilege escalation path selection, and evasion tuning. On ESXi, esxcli utilities expose system version and hostname. In cloud IaaS environments, authenticated API calls can return OS platform and instance metadata. This technique is frequently observed early in post-exploitation chains as part of host fingerprinting.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1082 System Information Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1082/
Elastic Detection Query
process where event.type == "start" and (
process.name : ("systeminfo.exe", "msinfo32.exe")
or (
process.name : "wmic.exe" and
process.command_line : ("* os get *", "* computersystem get *", "* bios get *", "* cpu get *", "* memorychip get *", "* csproduct get *")
)
or (
process.name : "reg.exe" and
process.command_line : "* query *" and
process.command_line : ("*CurrentVersion*", "*CurrentBuildNumber*", "*ProductName*", "*ReleaseId*", "*DisplayVersion*")
)
or (
process.name : ("powershell.exe", "pwsh.exe") and
process.command_line : (
"*Get-ComputerInfo*", "*Win32_OperatingSystem*", "*Win32_Bios*",
"*Win32_ComputerSystem*", "*OSVersion*", "*$env:OS*", "*gwmi Win32_OS*"
)
)
or (
process.name : "cmd.exe" and
process.command_line : "* ver *"
)
)Detects T1082 System Information Discovery via systeminfo.exe, msinfo32.exe, wmic OS/hardware enumeration, reg.exe version registry queries, and PowerShell WMI-based OS fingerprinting. Uses Elastic ECS process fields from Elastic Endpoint or Winlogbeat with Sysmon.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators running systeminfo.exe or msinfo32.exe for inventory or troubleshooting purposes, especially during business hours from admin workstations
- Software installers and update agents (e.g., Microsoft SCCM client, PDQ Deploy, Chocolatey) querying OS version via WMI or reg.exe to verify compatibility before installation
- Enterprise monitoring or ITSM agents (e.g., Tanium, BigFix, ServiceNow MID Server) that enumerate system configuration on a scheduled basis as part of asset management
Other platforms for T1082
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1System Information Enumeration via systeminfo.exe
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\systeminfo.exe, CommandLine containing redirect to temp file. Sysmon Event ID 11: File Create event for %TEMP%\sysinfo_out.txt. Security Event ID 4688 if command line auditing enabled.
- Test 2WMI OS and Hardware Discovery via wmic.exe
Expected signal: Sysmon Event ID 1: Four separate Process Create events for wmic.exe, each with distinct CommandLine arguments containing 'os get', 'computersystem get', 'bios get', 'cpu get'. Multiple rapid wmic executions from the same parent within seconds is particularly notable.
- Test 3PowerShell WMI-based System Profiling
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-CimInstance Win32_OperatingSystem' and 'Win32_ComputerSystem'. PowerShell ScriptBlock Log Event ID 4104 (Microsoft-Windows-PowerShell/Operational) with full script content showing WMI class queries.
- Test 4Registry Query for Windows Version Information
Expected signal: Sysmon Event ID 1: Three Process Create events for reg.exe, each querying HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion for different value names. Sysmon Event ID 13 (Registry Value Set) is NOT generated because these are read operations; detection relies on process creation with reg.exe command line analysis.
- Test 5Linux System Information Discovery via uname and /etc/os-release
Expected signal: Linux auditd syscall records for execve of /usr/bin/uname, /bin/cat with arguments /etc/os-release and /proc/version, /usr/bin/hostnamectl, /usr/bin/lscpu. Syslog entries if process accounting is enabled. In cloud environments, these commands may appear in CloudTrail/GCP audit logs if executed via SSM Session Manager or similar.
References (9)
- https://attack.mitre.org/techniques/T1082/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinfo_recon.yml
- https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire
- https://www.us-cert.gov/ncas/alerts/TA18-106A
- https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/
Unlock Pro Content
Get the full detection package for T1082 including response playbook, investigation guide, and atomic red team tests.