malware

OSInfo S0165

Type: malware
Platform: Windows
Created: 16 January 2018
Last modified: 20 January 2026

OSInfo is a custom tool used by APT3 to do internal discovery on a victim's computer and network. [1]

Techniques47th pct

TacticBottom 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0165

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
	Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory	Generic	test	ps_script	windows	PowerShell	Discovery Permission Groups Discovery Domain Groups	-	low	frack113	2022-03-17	2022-11-17	8c3a6607-b7dc-4f0d-a646-ef38c00b76ee
	Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	—	e5d36acd-acb4-4c6f-a13f-9eb203d50099
	Adversaries may attempt to find domain-level groups and permission settings. (...)	Generic	test	ps_module	windows	PowerShell	Discovery Permission Groups Discovery Local Groups	-	low	frack113	2021-12-15	2023-01-20	815bfc17-7fc6-4908-a55e-2f37b98cedb4
	Adversaries may attempt to find domain-level groups and permission settings. (...)	Generic	test	ps_script	windows	PowerShell	Discovery Permission Groups Discovery Local Groups	-	low	frack113	2021-12-15	2022-12-25	88f0884b-331d-403d-a3a1-b668cf035603
	Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs	Generic	test	-	windows	WinEventLog Security	Discovery Account Discovery Domain Account	-	high	Samir Bousseaden	2019-04-03	2022-07-13	35ba1d85-724d-42a3-889f-2e2362bcaf23
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
Splunk	The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-10-02	de7fcadc-04f3-11ec-a241-acde48001122
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	ff151c33-45fa-475d-af4f-c2f93571f4fe
	This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	1d2ab8ac-1a01-423b-9c39-001510eae8e8
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
Splunk	The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)	Generic	experimental	webserver	-	-	Initial Access, Persistence External Remote Services Discovery System Information Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	104658f4-afdc-499e-9719-17243f982681	-
Splunk	The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	26f02e96-c300-11eb-b611-acde48001122
Splunk	The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	1c34549e-c31b-11eb-996b-acde48001122
Splunk	The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	a0bdd2f6-c2ff-11eb-b918-acde48001122
Splunk	The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	42b4b438-beed-11eb-ba1d-acde48001122
Splunk	The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	dd04b29a-beed-11eb-87bc-acde48001122
	Enumerates Active Directory to determine computers that are joined to the domain	Generic	test	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	frack113	2022-02-12	—	1f6399cf-2c80-4924-ace1-6fcff3393480
	Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	11701de9-d5a5-44aa-8238-84252f131895
Splunk	The following analytic identifies the execution of `dsquery.exe` with command-line arguments used to discover domain users. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-05-13	b1a8ce04-04c2-11ec-bea7-acde48001122
Splunk	The following analytic detects the execution of `wmic.exe` with command-line arguments used to query for domain users. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-05-13	383572e0-04c5-11ec-bdcc-acde48001122
Splunk	The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-07-20	41243735-89a7-4c83-bcdd-570aa78f00a1
Splunk	The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	64c7adaa-48ee-483c-b0d6-7175bc65e6cc
Splunk	The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain groups. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Permission Groups Discovery Domain Groups	-	medium	Mauricio Velazco, Splunk	2021-08-27	2026-10-02	089c862f-5f83-49b5-b1c8-7e4ff66560c7
Splunk	The following analytic identifies the execution of `dsquery.exe` with command-line arguments used to query for domain groups. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Permission Groups Discovery Domain Groups	-	medium	Mauricio Velazco, Splunk	2021-08-26	2026-05-13	f0c9d62f-a232-4edd-b17e-bc409fb133d4
Splunk	The following analytic identifies the execution of `wmic.exe` with command-line arguments used to query for domain groups. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Permission Groups Discovery Domain Groups	-	medium	Mauricio Velazco, Splunk	2021-08-26	2026-05-13	a87736a6-95cd-4728-8689-3c64d5026b3e
	Domain user and group enumeration via network reconnaissance. (...)	Unsupported	unsupported	-	-	DCE/RPC · Zeek	Discovery Account Discovery Domain Account Discovery System Information Discovery	-	medium	Nate Guagenti (@neu5ron), Open Threat Research (OTR)	2020-05-03	2023-03-24	66a0bdc6-ee04-441a-9125-99d2eb547942
Splunk	The following analytic detects the execution of the `Get-DomainGroupMember` cmdlet from PowerView, identified through PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Permission Groups Discovery Domain Groups	-	medium	Mauricio Velazco, Splunk	2021-08-27	2026-05-13	10d62950-0de5-4199-a710-cff9ea79b413
Splunk	The following analytic detects the execution of `wmic.exe` with command-line arguments querying specific elevated domain groups. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Permission Groups Discovery Domain Groups	-	medium	Mauricio Velazco, Splunk	2021-08-26	2026-05-13	3f6bbf22-093e-4cb4-9641-83f47b8444b6
	Detects enumeration of the global catalog (that can be performed using BloodHound or others AD reconnaissance tools). (...)	Unsupported	unsupported	network_connection	windows	WinEventLog Security	Discovery Account Discovery Domain Account	-	medium	Chakib Gzenayi (@Chak092), Hosni Mribah	2020-05-11	2023-02-24	619b020f-0fd7-4f23-87db-3f51ef837a34
Splunk	This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Discovery System Information Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b4d4217a-6673-4fb6-837d-07a522bdf9f7	-
	Detects the export of a crital Registry key to a file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Query Registry	-	high	Oddvar Moe, Sander Wiebing, oscd.community	2020-10-12	2024-03-13	82880171-b475-4201-b811-e9c826cd5eaa
	Detects the export of the target Registry key to a file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Query Registry	-	low	Oddvar Moe, Sander Wiebing, oscd.community	2020-10-07	2024-03-13	f0e53e89-8d22-46ea-9db5-9d4796ee2f8a
	Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Network Share Discovery	-	high	@Kostastsale	2022-12-22	2024-08-23	c3d76afc-93df-461e-8e67-9b2bad3f2ac4

Title

Description

OSInfo S0165

OSInfo MITRE reference S0165

Standing S0165

Reach

Coverage

OSInfo detections S0165