Detect System Information Discovery in Splunk
Adversaries may attempt to gather detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Tools such as systeminfo, wmic, ver, and uname can be used to enumerate this data. Adversaries use this information to shape follow-on behaviors, including payload targeting, privilege escalation path selection, and evasion tuning. On ESXi, esxcli utilities expose system version and hostname. In cloud IaaS environments, authenticated API calls can return OS platform and instance metadata. This technique is frequently observed early in post-exploitation chains as part of host fingerprinting.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1082 System Information Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1082/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval Image_lower=lower(Image)
| eval CommandLine_lower=lower(CommandLine)
| eval ParentImage_lower=lower(ParentImage)
| eval IsSystemInfo=if(match(Image_lower, "(systeminfo\.exe|msinfo32\.exe)"), 1, 0)
| eval IsWmicOsEnum=if(match(Image_lower, "wmic\.exe") AND match(CommandLine_lower, "(os\s+get|computersystem\s+get|bios\s+get|cpu\s+get|memorychip\s+get|csproduct\s+get)"), 1, 0)
| eval IsRegQuery=if(match(Image_lower, "reg\.exe") AND match(CommandLine_lower, "query") AND match(CommandLine_lower, "(currentversion|currentbuildnumber|productname|releaseid|displayversion)"), 1, 0)
| eval IsPSEnum=if((match(Image_lower, "(powershell\.exe|pwsh\.exe)")) AND match(CommandLine_lower, "(get-computerinfo|win32_operatingsystem|win32_bios|win32_computersystem|osversion|\$env:os)"), 1, 0)
| eval SuspiciousParent=if(match(ParentImage_lower, "(wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe)"), 1, 0)
| eval OfficeParent=if(match(ParentImage_lower, "(winword\.exe|excel\.exe|outlook\.exe|powerpnt\.exe)"), 1, 0)
| where IsSystemInfo=1 OR IsWmicOsEnum=1 OR IsRegQuery=1 OR IsPSEnum=1
| eval TotalScore=IsSystemInfo + IsWmicOsEnum + IsRegQuery + IsPSEnum + SuspiciousParent + OfficeParent
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, IsSystemInfo, IsWmicOsEnum, IsRegQuery, IsPSEnum, SuspiciousParent, OfficeParent, TotalScore
| sort - _timeDetects system information discovery using Sysmon Event ID 1 (Process Creation). Identifies systeminfo.exe, msinfo32.exe, wmic OS/hardware queries, registry version key lookups, and PowerShell WMI-based OS enumeration. Scores each event across detection categories and parent process risk to help analysts quickly triage automated inventory from adversarial reconnaissance.
Data Sources
Required Sourcetypes
False Positives & Tuning
- IT operations scripts and monitoring agents (Zabbix, SolarWinds, SCCM inventory) that routinely collect system information
- Software installers checking OS version compatibility before installing packages
- Help desk and remote support tools that gather system information for troubleshooting tickets
- Vulnerability scanners and compliance auditing tools (Tenable, Qualys) enumerating host details
- Developer workstations where engineers query system info for build environment validation
Other platforms for T1082
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1System Information Enumeration via systeminfo.exe
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\systeminfo.exe, CommandLine containing redirect to temp file. Sysmon Event ID 11: File Create event for %TEMP%\sysinfo_out.txt. Security Event ID 4688 if command line auditing enabled.
- Test 2WMI OS and Hardware Discovery via wmic.exe
Expected signal: Sysmon Event ID 1: Four separate Process Create events for wmic.exe, each with distinct CommandLine arguments containing 'os get', 'computersystem get', 'bios get', 'cpu get'. Multiple rapid wmic executions from the same parent within seconds is particularly notable.
- Test 3PowerShell WMI-based System Profiling
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-CimInstance Win32_OperatingSystem' and 'Win32_ComputerSystem'. PowerShell ScriptBlock Log Event ID 4104 (Microsoft-Windows-PowerShell/Operational) with full script content showing WMI class queries.
- Test 4Registry Query for Windows Version Information
Expected signal: Sysmon Event ID 1: Three Process Create events for reg.exe, each querying HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion for different value names. Sysmon Event ID 13 (Registry Value Set) is NOT generated because these are read operations; detection relies on process creation with reg.exe command line analysis.
- Test 5Linux System Information Discovery via uname and /etc/os-release
Expected signal: Linux auditd syscall records for execve of /usr/bin/uname, /bin/cat with arguments /etc/os-release and /proc/version, /usr/bin/hostnamectl, /usr/bin/lscpu. Syslog entries if process accounting is enabled. In cloud environments, these commands may appear in CloudTrail/GCP audit logs if executed via SSM Session Manager or similar.
References (9)
- https://attack.mitre.org/techniques/T1082/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinfo_recon.yml
- https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire
- https://www.us-cert.gov/ncas/alerts/TA18-106A
- https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/
Unlock Pro Content
Get the full detection package for T1082 including response playbook, investigation guide, and atomic red team tests.