Detect System Information Discovery in CrowdStrike LogScale
Adversaries may attempt to gather detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Tools such as systeminfo, wmic, ver, and uname can be used to enumerate this data. Adversaries use this information to shape follow-on behaviors, including payload targeting, privilege escalation path selection, and evasion tuning. On ESXi, esxcli utilities expose system version and hostname. In cloud IaaS environments, authenticated API calls can return OS platform and instance metadata. This technique is frequently observed early in post-exploitation chains as part of host fingerprinting.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1082 System Information Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1082/
LogScale Detection Query
#event_simpleName=ProcessRollup2
| FileName = /^(systeminfo|msinfo32|wmic|reg|powershell|pwsh|cmd)\.exe$/i
| IsSystemInfo := if(FileName = /^(systeminfo|msinfo32)\.exe$/i, 1, 0)
| IsWmicOsEnum := if(
FileName = /^wmic\.exe$/i AND
CommandLine = /(?i)(os\s+get|computersystem\s+get|bios\s+get|cpu\s+get|memorychip\s+get|csproduct\s+get)/,
1, 0
)
| IsRegQuery := if(
FileName = /^reg\.exe$/i AND
CommandLine = /(?i)\bquery\b/ AND
CommandLine = /(?i)(currentversion|currentbuildnumber|productname|releaseid|displayversion)/,
1, 0
)
| IsPSEnum := if(
FileName = /^(powershell|pwsh)\.exe$/i AND
CommandLine = /(?i)(get-computerinfo|win32_operatingsystem|win32_bios|win32_computersystem|osversion|\$env:os|gwmi\s+win32_os)/,
1, 0
)
| IsCmdVer := if(
FileName = /^cmd\.exe$/i AND
CommandLine = /(?i)\bver\b/,
1, 0
)
| where IsSystemInfo = 1 OR IsWmicOsEnum = 1 OR IsRegQuery = 1 OR IsPSEnum = 1 OR IsCmdVer = 1
| SuspiciousParent := if(
ParentBaseFileName = /^(wscript|cscript|mshta|rundll32|regsvr32|svchost|services)\.exe$/i,
1, 0
)
| OfficeParent := if(
ParentBaseFileName = /^(winword|excel|outlook|powerpnt|mspub)\.exe$/i,
1, 0
)
| TotalScore := IsSystemInfo + IsWmicOsEnum + IsRegQuery + IsPSEnum + IsCmdVer + SuspiciousParent + OfficeParent
| select(
[timestamp, ComputerName, UserName, FileName, CommandLine,
ParentBaseFileName, ParentCommandLine,
IsSystemInfo, IsWmicOsEnum, IsRegQuery, IsPSEnum, IsCmdVer,
SuspiciousParent, OfficeParent, TotalScore]
)
| sort(field=timestamp, order=desc)Detects T1082 System Information Discovery in CrowdStrike Falcon LogScale using ProcessRollup2 events. Matches systeminfo/msinfo32, wmic OS/hardware enumeration, reg.exe version registry queries, PowerShell WMI fingerprinting, and cmd.exe ver. Computes a composite risk score and surfaces suspicious or Office parent process chains for analyst triage.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor itself or other EDR agents performing self-registration and host fingerprinting on startup, which may invoke WMI or registry queries to identify OS version and architecture for sensor compatibility checks
- Enterprise software distribution systems (SCCM, Intune, Jamf for Windows) that enumerate OS version, installed hotfixes, and hardware configuration before deploying software packages or enforcing compliance baselines
- Penetration testers or red teamers operating under an authorized engagement who run systeminfo.exe or PowerShell WMI discovery as part of a post-exploitation simulation with documented scope
Other platforms for T1082
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1System Information Enumeration via systeminfo.exe
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\systeminfo.exe, CommandLine containing redirect to temp file. Sysmon Event ID 11: File Create event for %TEMP%\sysinfo_out.txt. Security Event ID 4688 if command line auditing enabled.
- Test 2WMI OS and Hardware Discovery via wmic.exe
Expected signal: Sysmon Event ID 1: Four separate Process Create events for wmic.exe, each with distinct CommandLine arguments containing 'os get', 'computersystem get', 'bios get', 'cpu get'. Multiple rapid wmic executions from the same parent within seconds is particularly notable.
- Test 3PowerShell WMI-based System Profiling
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-CimInstance Win32_OperatingSystem' and 'Win32_ComputerSystem'. PowerShell ScriptBlock Log Event ID 4104 (Microsoft-Windows-PowerShell/Operational) with full script content showing WMI class queries.
- Test 4Registry Query for Windows Version Information
Expected signal: Sysmon Event ID 1: Three Process Create events for reg.exe, each querying HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion for different value names. Sysmon Event ID 13 (Registry Value Set) is NOT generated because these are read operations; detection relies on process creation with reg.exe command line analysis.
- Test 5Linux System Information Discovery via uname and /etc/os-release
Expected signal: Linux auditd syscall records for execve of /usr/bin/uname, /bin/cat with arguments /etc/os-release and /proc/version, /usr/bin/hostnamectl, /usr/bin/lscpu. Syslog entries if process accounting is enabled. In cloud environments, these commands may appear in CloudTrail/GCP audit logs if executed via SSM Session Manager or similar.
References (9)
- https://attack.mitre.org/techniques/T1082/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinfo_recon.yml
- https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire
- https://www.us-cert.gov/ncas/alerts/TA18-106A
- https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/
Unlock Pro Content
Get the full detection package for T1082 including response playbook, investigation guide, and atomic red team tests.