Systeminfo S0096

Type: tool
Created: 31 May 2017
Last modified: 16 April 2025

Systeminfo is a Windows utility that can be used to gather detailed information about a computer. [1]

TechniqueBottom 5%

TacticBottom 6%

Threat groupsunranked

Campaignsunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Systeminfo MITRE reference S0096

System Information Discovery T1082 ↗

Systeminfo can be used to gather information about the operating system.2

Discovery54 detection rules

Standing S0096

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Technique1Bottom 5%

5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat groups1061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns385% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique54medTop 6%

94th percentile · 94% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique41med

Systeminfo detections S0096

54 distinct rules cover the 1 technique recorded for this tool. 36 Sigma · 18 Splunk.

1 covered by at least one rule54 distinct rules in total

Showing 1-50 of 54 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
Splunk	The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)	Generic	experimental	webserver	-	-	Initial Access, Persistence External Remote Services Discovery System Information Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	104658f4-afdc-499e-9719-17243f982681	-
	Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	11701de9-d5a5-44aa-8238-84252f131895
	Domain user and group enumeration via network reconnaissance. (...)	Unsupported	unsupported	-	-	DCE/RPC · Zeek	Discovery Account Discovery Domain Account Discovery System Information Discovery	-	medium	Nate Guagenti (@neu5ron), Open Threat Research (OTR)	2020-05-03	2023-03-24	66a0bdc6-ee04-441a-9125-99d2eb547942
Splunk	This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Discovery System Information Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b4d4217a-6673-4fb6-837d-07a522bdf9f7	-
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Network Service Discovery Discovery System Information Discovery	-	high	Georg Lauenstein (sure[secure])	2022-09-19	2023-03-23	98b53e78-ebaf-46f8-be06-421aafd176d9
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Rootkit Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	d1b088de-c47a-4572-9339-bdcc26493b32
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Stealth Rootkit Discovery System Information Discovery	-	medium	Michael Haag, Splunk	2022-06-17	2026-10-09	6df99886-0e04-4c11-8b88-325747419278
	Detects a set of suspicious network related commands often used in recon stages	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Information Discovery	-	high	Florian Roth (Nextron Systems)	2022-02-07	—	e6313acd-208c-44fc-a0ff-db85d572e90e
	Detects the use of grep to identify information about the operating system architecture. (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	d27ab432-2199-483f-a297-03633c05bae6
	Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	2025-11-24	43e26eb5-cd58-48d1-8ce9-a273f5d298d8
	Detects the use of grep to discover specific files created by the GobRAT malware	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	e34cfa0c-0a50-4210-9cb3-5632d08eb041
	Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery Execution Windows Management Instrumentation	-	medium	Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2023-02-14	2025-03-17	e568650b-5dcd-4658-8f34-ded0b1e13992
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
	Detects the execution of System Informer, a task manager tool to view and manipulate processes, kern (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Stealth Hide Artifacts Discovery System Information Discovery	-	medium	Florian Roth (Nextron Systems)	2023-05-08	2024-11-23	5722dff1-4bdd-4949-86ab-fbaf707e767a
	Detects execution of a set of builtin commands often used in recon stages by different attack groups	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Information Discovery	-	medium	Florian Roth (Nextron Systems), Markus Neis	2018-08-22	2023-02-24	2887e914-ce96-435f-8105-593937e90757
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	Use of hostname to get information	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-01	—	7be5fb68-f9ef-476d-8b51-0256ebece19e
	Detects usage of the "systeminfo" command to retrieve information	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-01	2022-07-14	0ef56343-059e-4cb6-adc1-4c3c967c5e46
	Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	high	Florian Roth (Nextron Systems)	2021-12-28	—	7124aebe-4cd7-4ccb-8df0-6d6b93c96795
	Use of reg to get MachineGuid information	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-01	—	f5240972-3938-4e56-8e4b-e33893176c1f
	Detects system information discovery commands	Generic	stable	file_event	linux	Linux Auditd	Discovery System Information Discovery	-	informational	Ömer Günal, oscd.community	2020-10-08	2022-11-26	1f358e2e-cb63-43c3-b575-dfb072a6814f
	An adversary might use WMI to discover information about the system, such as the volume name, size, (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery Execution Windows Management Instrumentation	-	medium	Stephen Lincoln '@slincoln-aiq' (AttackIQ)	2024-02-02	2025-10-20	c79da740-5030-45ec-a2e0-479e824a562c
	Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. (...)	Generic	experimental	process_creation	linux	Linux Auditd	Discovery Process Discovery Discovery System Information Discovery	-	low	Milad Cheraghi	2025-05-30	2025-12-05	b207d563-a1d9-4275-b349-77d1eb55aa6d
	Detects system information discovery commands	Generic	stable	process_creation	linux	Sysmon	Discovery System Information Discovery	-	informational	Ömer Günal, oscd.community	2020-10-08	2021-09-14	42df45e7-e6e9-43b5-8f26-bec5b39cc239
	Detects System Information Discovery commands	Generic	test	file_event	linux	Linux Auditd	Discovery System Information Discovery	-	low	Pawel Mazur	2021-09-03	2023-03-06	f34047d9-20d3-4e8b-8672-0a35cc50dc71
Splunk	The following analytic identifies system information discovery techniques, such as the execution of commands like `wmic qfe`, `systeminfo`, and `hostname`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Patrick Bareiss, Splunk	2020-10-14	2026-10-09	8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
	Detects the use of "ioreg" which will show I/O Kit registry information. (...)	Generic	test	process_creation	macos	-	Discovery System Information Discovery	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	2024-01-02	2d5e7a8b-f484-4a24-945d-7f0efd52eab0
	Detects the use of "sw_vers" for system information discovery	Generic	test	process_creation	macos	-	Discovery System Information Discovery	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	—	5de06a6f-673a-4fc0-8d48-bcfe3837b033
	Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. (...)	Generic	test	process_creation	macos	-	Discovery System Information Discovery Stealth, Discovery Virtualization/Sandbox Evasion System Checks	-	medium	Stephen Lincoln `@slincoln_aiq` (AttackIQ)	2024-01-02	—	4809c683-059b-4935-879d-36835986f8cf
	Detects attempts to query system information directly from the Windows Registry.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	lazarg	2025-06-12	2025-10-25	0022869c-49f7-4ff2-ba03-85ac42ddac58
	Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. (...)	Generic	test	process_creation	macos	-	Discovery System Information Discovery Stealth, Discovery Virtualization/Sandbox Evasion System Checks	-	medium	Pratinav Chandra	2024-05-27	—	6ff08e55-ea53-4f27-94a1-eff92e6d9d5c
	Detects the use of the WMI command-line (WMIC) utility to identify and display various system inform (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-19	2024-01-15	d85ecdd7-b855-4e6e-af59-d9c78b5b861e
	Detects the use of the WMI command-line (WMIC) utility to identify and display various system inform (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	medium	TropChaud	2023-01-26	2023-12-19	9d5a1274-922a-49d0-87f3-8c653483b909
Splunk	The following analytic detects the execution of suspicious processes on systems identified as web servers. (...)	Generic	experimental	process_creation	windows	Sysmon	Discovery System Information Discovery	-	medium	David Dorsey, Splunk	2019-10-16	2026-05-13	ec3b7601-689a-4463-94e0-c9f45638efb9	-
Splunk	The following analytic identifies the execution of the Windows built-in tool FSUTIL with the "FSINFO" or "Volume" parameters, in order to discover file system and disk information. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2022-12-06	2026-05-13	2181f261-93e6-4166-a5a9-47deac58feff
Splunk	The following analytic identifies four or more distinct post-exploitation behaviors on a Windows system. (...)	Correlation	stable	-	-	-	Collection Clipboard Data Credential Access OS Credential Dumping Discovery Permission Groups Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Credential Access Unsecured Credentials	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	edb930df-64c2-4bb7-9b5c-889ed53fb973
Splunk	The following analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. (...)	Anomaly	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Michael Haag, Splunk	2025-04-17	2026-05-13	8db47e12-9c3e-4f5a-b0d6-e42a1895cd4f
Splunk	The following analytic identifies execution of Sysinternals PsTools and Sysinternals Suit binaries t (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Remote System Discovery Discovery System Information Discovery	-	medium	Nasreddine Bencherchali	2025-10-24	2026-05-13	9a5f4b3e-1d2b-4c6f-9a8e-3b7d2f5c1a6e
Splunk	Detects the execution of the WinPEAS PowerShell script via default function names used within the script. (...)	Generic	stable	ps_script	windows	PowerShell	Reconnaissance Gather Victim Host Information Software Client Configurations Reconnaissance Gather Victim Network Information Discovery Group Policy Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	5cb208df-e1aa-478d-ab2f-8270ff9999b9
Splunk	The following analytic detects the use of WMIC (Windows Management Instrumentation Command-line) for CPU discovery, often executed with commands such as “wmic cpu get name” This behavior is commonly associated with reconnaissance, where adversaries seek to gather details about system hardware, assess processing power, or determine if the environment is virtualized. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-05-13	6fc46cae-a8c0-4296-b07a-8e52d4322587