1200KM / detection
T0888 Remote System Information Discovery — Detection Rules
Detection workspace for T0888 Remote System Information Discovery: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0787 Detection of Remote System Information Discovery
AN1919 Analytic 1919
Real-time monitoring identifies remote Windows system-information queries using WMI/CIM, WinRM, PowerShell remoting, or equivalent management tooling where the command names a non-local target and the account/source is outside the approved management baseline. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
AN2148 Analytic 2148
Real-time monitoring identifies an account on an ICS Linux host invoking SSH, SNMP, or another remote-management utility with a non-local target to query remote system identity, hardware, operating-system, or inventory information outside the approved management baseline. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
AN2186 Analytic 2186
Real-time monitoring identifies Simple Network Management Protocol (SNMP) GET requests targeting system information Object Identifiers (OIDs) from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, directed at Industrial Control System (ICS) server or device IPs. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
AN2249 Analytic 2249
Real-time monitoring identifies Industrial Control System (ICS) protocol requests targeting device identification and system metadata objects from a source not in the approved control server list, specifically aimed at device metadata rather than process values. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.