Detect System Information Discovery in Microsoft Sentinel
Adversaries may attempt to gather detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Tools such as systeminfo, wmic, ver, and uname can be used to enumerate this data. Adversaries use this information to shape follow-on behaviors, including payload targeting, privilege escalation path selection, and evasion tuning. On ESXi, esxcli utilities expose system version and hostname. In cloud IaaS environments, authenticated API calls can return OS platform and instance metadata. This technique is frequently observed early in post-exploitation chains as part of host fingerprinting.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1082 System Information Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1082/
KQL Detection Query
let SysInfoTools = dynamic(["systeminfo.exe", "msinfo32.exe"]);
let WmicSysPatterns = dynamic(["os get", "computersystem get", "bios get", "cpu get", "memorychip get", "csproduct get"]);
let RegVersionPaths = dynamic(["CurrentVersion", "CurrentBuildNumber", "ProductName", "ReleaseId", "DisplayVersion"]);
let PSInfoPatterns = dynamic(["Get-ComputerInfo", "Get-WmiObject Win32_OperatingSystem", "Get-CimInstance Win32_OperatingSystem", "[System.Environment]::OSVersion", "$env:OS", "gwmi Win32_OS"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
FileName in~ (SysInfoTools)
or (FileName =~ "wmic.exe" and ProcessCommandLine has_any (WmicSysPatterns))
or (FileName =~ "reg.exe" and ProcessCommandLine has_any (RegVersionPaths) and ProcessCommandLine has "query")
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any (PSPatterns))
or (FileName =~ "cmd.exe" and ProcessCommandLine has "ver")
)
| extend IsSystemInfo = FileName in~ (SysInfoTools)
| extend IsWmicOsEnum = FileName =~ "wmic.exe" and ProcessCommandLine has_any (WmicSysPatterns)
| extend IsRegQuery = FileName =~ "reg.exe" and ProcessCommandLine has_any (RegVersionPaths)
| extend IsPSEnum = FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any (PSInfoPatterns)
| extend SuspiciousParent = InitiatingProcessFileName in~ ("cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "svchost.exe", "services.exe")
| extend OfficeParent = InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "mspub.exe")
| where IsSystemInfo or IsWmicOsEnum or IsRegQuery or IsPSEnum
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
IsSystemInfo, IsWmicOsEnum, IsRegQuery, IsPSEnum,
SuspiciousParent, OfficeParent
| sort by Timestamp descDetects system information discovery commands using Microsoft Defender for Endpoint DeviceProcessEvents. Monitors for systeminfo.exe, msinfo32.exe, wmic OS/hardware enumeration, registry queries for Windows version keys, and PowerShell cmdlets that retrieve OS/hardware details. Tags suspicious parent processes (LOLBins, Office apps) to help triage automated discovery versus post-exploitation reconnaissance.
Data Sources
Required Tables
False Positives & Tuning
- IT operations scripts and monitoring agents (Zabbix, SolarWinds, SCCM inventory) that routinely collect system information
- Software installers checking OS version compatibility before installing packages
- Help desk and remote support tools that gather system information for troubleshooting tickets
- Vulnerability scanners and compliance auditing tools (Tenable, Qualys, CrowdStrike Spotlight) enumerating host details
- Developer workstations where engineers query system info for build environment validation
Other platforms for T1082
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1System Information Enumeration via systeminfo.exe
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\systeminfo.exe, CommandLine containing redirect to temp file. Sysmon Event ID 11: File Create event for %TEMP%\sysinfo_out.txt. Security Event ID 4688 if command line auditing enabled.
- Test 2WMI OS and Hardware Discovery via wmic.exe
Expected signal: Sysmon Event ID 1: Four separate Process Create events for wmic.exe, each with distinct CommandLine arguments containing 'os get', 'computersystem get', 'bios get', 'cpu get'. Multiple rapid wmic executions from the same parent within seconds is particularly notable.
- Test 3PowerShell WMI-based System Profiling
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-CimInstance Win32_OperatingSystem' and 'Win32_ComputerSystem'. PowerShell ScriptBlock Log Event ID 4104 (Microsoft-Windows-PowerShell/Operational) with full script content showing WMI class queries.
- Test 4Registry Query for Windows Version Information
Expected signal: Sysmon Event ID 1: Three Process Create events for reg.exe, each querying HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion for different value names. Sysmon Event ID 13 (Registry Value Set) is NOT generated because these are read operations; detection relies on process creation with reg.exe command line analysis.
- Test 5Linux System Information Discovery via uname and /etc/os-release
Expected signal: Linux auditd syscall records for execve of /usr/bin/uname, /bin/cat with arguments /etc/os-release and /proc/version, /usr/bin/hostnamectl, /usr/bin/lscpu. Syslog entries if process accounting is enabled. In cloud environments, these commands may appear in CloudTrail/GCP audit logs if executed via SSM Session Manager or similar.
References (9)
- https://attack.mitre.org/techniques/T1082/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinfo_recon.yml
- https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire
- https://www.us-cert.gov/ncas/alerts/TA18-106A
- https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/
Unlock Pro Content
Get the full detection package for T1082 including response playbook, investigation guide, and atomic red team tests.