T1082 System Information Discovery — Detection Rules

Source-backed rule directory

• Bitbucket User Details Export Attempt Detected · test · medium · {"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."}
• Bitbucket User Permissions Export Attempt · test · medium · {"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."}
• System Information Discovery - Auditd · test · low · {"product":"linux","service":"auditd"}
• System and Hardware Information Discovery · stable · informational · {"product":"linux","service":"auditd"}
• System Info Discovery via Sysinfo Syscall · experimental · low · {"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall\n-a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall\n"}
• OS Architecture Discovery Via Grep · test · low · {"category":"process_creation","product":"linux"}
• Potential GobRAT File Discovery Via Grep · test · high · {"category":"process_creation","product":"linux"}
• Container Residence Discovery Via Proc Virtual FS · test · low · {"category":"process_creation","product":"linux"}
• Docker Container Discovery Via Dockerenv Listing · test · low · {"category":"process_creation","product":"linux"}
• Potential Container Discovery Via Inodes Listing · test · low · {"category":"process_creation","product":"linux"}
• System Information Discovery · stable · informational · {"product":"linux","category":"process_creation"}
• System Information Discovery Using Ioreg · test · medium · {"product":"macos","category":"process_creation"}
• System Information Discovery Using sw_vers · test · medium · {"product":"macos","category":"process_creation"}
• System Information Discovery Via Sysctl - MacOS · test · medium · {"product":"macos","category":"process_creation"}
• System Information Discovery Using System_Profiler · test · medium · {"product":"macos","category":"process_creation"}
• Cisco Discovery · test · low · {"product":"cisco","service":"aaa"}
• HackTool - WinPwn Execution - ScriptBlock · test · high · {"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"}
• System Information Discovery via Registry Queries · experimental · low · {"category":"process_creation","product":"windows"}
• Suspicious Kernel Dump Using Dtrace · test · high · {"product":"windows","category":"process_creation"}
• HackTool - PCHunter Execution · test · high · {"category":"process_creation","product":"windows"}
• HackTool - winPEAS Execution · test · high · {"category":"process_creation","product":"windows"}
• HackTool - WinPwn Execution · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Execution of Hostname · test · low · {"category":"process_creation","product":"windows"}
• Network Reconnaissance Activity · test · high · {"category":"process_creation","product":"windows"}
• PUA - System Informer Execution · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Query of MachineGUID · test · low · {"category":"process_creation","product":"windows"}
• Potential Suspicious Activity Using SeCEdit · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Execution of Systeminfo · test · low · {"category":"process_creation","product":"windows"}
• Potential Product Class Reconnaissance Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Uncommon System Information Discovery Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
• System Disk And Volume Reconnaissance Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0525 System Discovery via Native and Remote Utilities

AN1452 Analytic 1452

Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.

AN1453 Analytic 1453

Execution of system enumeration commands such as `uname`, `df`, `uptime`, `hostname`, `lscpu`, and `cat /etc/os-release` through local terminal or scripts.

AN1454 Analytic 1454

Execution of system info utilities like `systemsetup`, `sw_vers`, `uname`, or `sysctl` by terminal or scripted processes.

AN1455 Analytic 1455

Execution of `esxcli system hostname get`, `esxcli system version get`, or `esxcli hardware` commands through SSH or local shell.

AN1456 Analytic 1456

Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.

AN1457 Analytic 1457

Execution of `show version`, `show hardware`, or `show system` commands through CLI via SSH or console.