T1082 System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- HackTool - PCHunter Executionhightest · windows
- HackTool - WinPwn Executionhightest · windows
- HackTool - WinPwn Execution - ScriptBlockhightest · windows
- HackTool - winPEAS Executionhightest · windows
- Network Reconnaissance Activityhightest · windows
- Potential GobRAT File Discovery Via Grephightest · linux
- Suspicious Kernel Dump Using Dtracehightest · windows
- Bitbucket User Details Export Attempt Detectedmediumtest · bitbucket
- Bitbucket User Permissions Export Attemptmediumtest · bitbucket
- PUA - System Informer Executionmediumtest · windows
- Potential Product Class Reconnaissance Via Wmic.EXEmediumtest · windows
- Potential Suspicious Activity Using SeCEditmediumtest · windows
- System Disk And Volume Reconnaissance Via Wmic.EXEmediumtest · windows
- System Information Discovery Using Ioregmediumtest · macos
- System Information Discovery Using System_Profilermediumtest · macos
- System Information Discovery Using sw_versmediumtest · macos
- System Information Discovery Via Sysctl - MacOSmediumtest · macos
- Uncommon System Information Discovery Via Wmic.EXEmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.