Loading interactive filters…

1200KM / simulation

T1082 System Information Discovery — Attack Simulation

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or…

Complete technique description

Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the <code>systemsetup</code> configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. <code>show version</code>).[US-CERT-TA18-106A] On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.[Crowdstrike Hypervisor Jackpotting Pt 2 2021][Varonis]

Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.[Amazon Describe Instance][Google Instances Resource][Microsoft Virutal Machine API]

System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.[OSX.FairyTale][20 macOS Common Tools and Techniques]

Official technique definition · Open in the interactive matrix

Detection telemetry and configuration

These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.

Command Execution · source-mapped

DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.

Providers and collection configuration

PowerShell Script Block Logging: Script content via event 4104 when configured; channel depends on PowerShell edition.
Sysmon process events: Interpreter launch and parent context, not full script content.
Linux Audit: execve-family execution context; shell built-ins need additional instrumentation.

Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: interpreter, command_line, actor_uid, session_id.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0064",
  "collector": "illustrative-lab-collector",
  "observation": {
    "interpreter": "/bin/sh",
    "command_line": "printf LAB_TELEMETRY_CHECK",
    "actor_uid": 1000,
    "session_id": "lab-session-1"
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

Instance Enumeration · source-mapped

DC0075 collection page — Include supported read management APIs and retain caller, scope, query/filter and result; read auditing differs between providers.

Providers and collection configuration

AWS CloudTrail: Management-plane API activity; supported resource/data events require separate selectors.
Azure Monitor Activity Log: Azure resource control-plane operations; resource data-plane logs are separate.
Google Cloud Audit Logs: Admin Activity and other categories; configure Data Access where required.

In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.

Required normalized fields: action, region, actor, result.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0075",
  "collector": "illustrative-lab-collector",
  "observation": {
    "action": "list_instances",
    "region": "lab-region",
    "actor": "lab-reader",
    "result": "success"
  }
}

Visibility limits: AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.

Process Creation · source-mapped

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

Windows Registry Key Modification · source-mapped

DC0063 collection page — Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.

Providers and collection configuration

Microsoft Sysmon: Windows event-based collection; enable the event types needed below.

On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.

Required normalized fields: registry_path, event_type, value_type, value.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0063",
  "collector": "illustrative-lab-collector",
  "observation": {
    "registry_path": "HKCU\\Software\\Lab\\Mode",
    "event_type": "SetValue",
    "value_type": "DWORD",
    "value": 1
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

Detection rules and analytic guidance

Open the dedicated detection workspace · Existing query engineering

DET0525 System Discovery via Native and Remote Utilities

MITRE detection strategy

AN1452 Analytic 1452

Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.

Platforms: Windows.

Process Creation — WinEventLog:Security; channel EventCode=4688.
Command Execution — WinEventLog:PowerShell; channel EventCode=4103, 4104, 4105, 4106.
Process Creation — WinEventLog:Sysmon; channel EventCode=1.
Windows Registry Key Modification — WinEventLog:Sysmon; channel EventCode=13, 14.

AN1453 Analytic 1453

Execution of system enumeration commands such as `uname`, `df`, `uptime`, `hostname`, `lscpu`, and `cat /etc/os-release` through local terminal or scripts.

Platforms: Linux.

Process Creation — auditd:SYSCALL; channel execve.

AN1454 Analytic 1454

Execution of system info utilities like `systemsetup`, `sw_vers`, `uname`, or `sysctl` by terminal or scripted processes.

Platforms: macOS.

Command Execution — macos:unifiedlog; channel log show --predicate 'process == <utility>'.

AN1455 Analytic 1455

Execution of `esxcli system hostname get`, `esxcli system version get`, or `esxcli hardware` commands through SSH or local shell.

Platforms: ESXi.

Command Execution — esxi:vmkernel; channel /var/log/vmkernel.log.

AN1456 Analytic 1456

Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.

Platforms: IaaS.

Instance Enumeration — AWS:CloudTrail; channel DescribeInstances, GetConsoleOutput, DescribeImages.

AN1457 Analytic 1457

Execution of `show version`, `show hardware`, or `show system` commands through CLI via SSH or console.

Platforms: Network Devices.

Command Execution — networkdevice:syslog; channel Privilege-level command execution.

Source rule directory and observation requirements

31 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

Bitbucket User Details Export Attempt Detected — test; product: bitbucket; service: audit; definition: Requirements: "Advance" log level is required to receive these audit events..
Bitbucket User Permissions Export Attempt — test; product: bitbucket; service: audit; definition: Requirements: "Advance" log level is required to receive these audit events..
System Information Discovery - Auditd — test; product: linux; service: auditd.
System and Hardware Information Discovery — stable; product: linux; service: auditd.
System Info Discovery via Sysinfo Syscall — experimental; product: linux; service: auditd; definition: Required auditd configuration: -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall .
OS Architecture Discovery Via Grep — test; category: process_creation; product: linux.
Potential GobRAT File Discovery Via Grep — test; category: process_creation; product: linux.
Container Residence Discovery Via Proc Virtual FS — test; category: process_creation; product: linux.
Docker Container Discovery Via Dockerenv Listing — test; category: process_creation; product: linux.
Potential Container Discovery Via Inodes Listing — test; category: process_creation; product: linux.
System Information Discovery — stable; product: linux; category: process_creation.
System Information Discovery Using Ioreg — test; product: macos; category: process_creation.
System Information Discovery Using sw_vers — test; product: macos; category: process_creation.
System Information Discovery Via Sysctl - MacOS — test; product: macos; category: process_creation.
System Information Discovery Using System_Profiler — test; product: macos; category: process_creation.
Cisco Discovery — test; product: cisco; service: aaa.
HackTool - WinPwn Execution - ScriptBlock — test; category: ps_script; product: windows; definition: Requirements: Script Block Logging must be enabled.
System Information Discovery via Registry Queries — experimental; category: process_creation; product: windows.
Suspicious Kernel Dump Using Dtrace — test; product: windows; category: process_creation.
HackTool - PCHunter Execution — test; category: process_creation; product: windows.
HackTool - winPEAS Execution — test; category: process_creation; product: windows.
HackTool - WinPwn Execution — test; category: process_creation; product: windows.
Suspicious Execution of Hostname — test; category: process_creation; product: windows.
Network Reconnaissance Activity — test; category: process_creation; product: windows.
PUA - System Informer Execution — test; category: process_creation; product: windows.
Suspicious Query of MachineGUID — test; category: process_creation; product: windows.
Potential Suspicious Activity Using SeCEdit — test; category: process_creation; product: windows.
Suspicious Execution of Systeminfo — test; category: process_creation; product: windows.
Potential Product Class Reconnaissance Via Wmic.EXE — test; category: process_creation; product: windows.
Uncommon System Information Discovery Via Wmic.EXE — test; category: process_creation; product: windows.
System Disk And Volume Reconnaissance Via Wmic.EXE — test; category: process_creation; product: windows.

Before treating a rule as coverage

Read the actual condition and logsource; identify attacker-side, victim-side or third-party visibility.
Map native sensor fields, parse times and identities, then compile for the selected backend.
Replay a behavior-positive case, a normal control, an authorized look-alike and a missing-telemetry case.
Record matches and misses with rule version and source events. No match is inconclusive when required telemetry is absent.

Anomaly-based detection

No exact technique-specific Atlas model is present for T1082 in the selected source snapshot. The following is a design worksheet, not a newly validated model.

Anomaly engineering worksheet

Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.

Script and command execution: Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility.
Cloud control plane: Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity.
Endpoint activity: Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity.

Define an entity/peer group and feature; exclude the evaluation period from baseline training.
Use representative normal and maintenance activity. Do not invent a production threshold from a synthetic example.
Evaluate held-out behavior-positive and benign cases; measure false positives, misses and telemetry loss separately.
Keep abnormality separate from maliciousness. Correlate with the behavior-specific source evidence.

Anomaly Detection Atlas · Baseline, validation and blind spots

Attack tools and documented software

cmd

Covenant

Diskpart

dsquery

Empire

Koadic

PoshC2

Pupy

QuasarRAT

Remcos

ShimRatReporter

SILENTTRINITY

Systeminfo

Software observed in source procedures

These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.

363 source-documented software associations

S0013 PlugX — malware.
PlugX has collected system information including OS version, processor information, RAM size, location, host name, IP, and screen size of the infected host.[Eset PlugX Korplug Mustang Panda March 2022]
Exact relationship: relationship--8282f068-c2d3-4673-b683-7fbd3a59f38e
S0015 Ixeshe — malware.
Ixeshe collects the computer name of the victim's system during the initial infection.[Trend Micro IXESHE 2012]
Exact relationship: relationship--5eb5ee0e-d186-40d3-a433-9562f85fdf6b
S0017 BISCUIT — malware.
BISCUIT has a command to collect the processor type, operation system, computer name, and whether the system is a laptop or PC.[Mandiant APT1]
Exact relationship: relationship--6a008820-b742-4ec0-ad56-7494ca911da7
S0021 Derusbi — malware.
Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.[Fidelis Turbo]
Exact relationship: relationship--5d2ca571-9e66-4949-b3a1-978c47398b18
S0022 Uroburos — malware.
Uroburos has the ability to gather basic system information and run the POSIX API `gethostbyname`.[Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023]
Exact relationship: relationship--a0e4dc2c-1977-4c4c-a5ee-4710fb3ef1a5
S0024 Dyre — malware.
Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.[Malwarebytes Dyreza November 2015]
Exact relationship: relationship--c1a4334d-8975-4ca2-8734-d6c26e36702a
S0031 BACKSPACE — malware.
During its initial execution, BACKSPACE extracts operating system information from the infected host.[FireEye APT30]
Exact relationship: relationship--16cb7ede-b431-4711-bcb1-91bc925663e5
S0032 gh0st RAT — malware.
gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.[Gh0stRAT ATT March 2019]
Exact relationship: relationship--aee29ae1-4544-4fc8-b30b-4717888991ca
S0043 BUBBLEWRAP — malware.
BUBBLEWRAP collects system information, including the operating system version and hostname.[FireEye admin@338]
Exact relationship: relationship--ea4c3651-b2a3-418e-8d3b-3c8075b988ef
S0045 ADVSTORESHELL — malware.
ADVSTORESHELL can run Systeminfo to gather information about the victim.[ESET Sednit Part 2][Bitdefender APT28 Dec 2015]
Exact relationship: relationship--090a553a-b863-4214-aa3b-cf8ea7ba2d68
S0046 CozyCar — malware.
A system info module in CozyCar gathers information on the victim host’s configuration.[F-Secure CozyDuke]
Exact relationship: relationship--166c430d-0272-4dca-8d30-318cda0a0a63
S0048 PinchDuke — malware.
PinchDuke gathers system configuration information.[F-Secure The Dukes]
Exact relationship: relationship--7b29c94f-1834-42ac-933c-ae6cd125e87a
S0051 MiniDuke — malware.
MiniDuke can gather the hostname on a compromised machine.[ESET Dukes October 2019]
Exact relationship: relationship--30e6bb1e-7c6a-4fff-8163-f5a065d2d960
S0058 SslMM — malware.
SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.[Baumgartner Naikon 2015]
Exact relationship: relationship--fbfc610a-5355-40fc-b5a1-059e89a1eb8d
S0059 WinMM — malware.
WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.[Baumgartner Naikon 2015]
Exact relationship: relationship--2e367a09-1d94-4ea4-984c-a592b769fffa
S0060 Sys10 — malware.
Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.[Baumgartner Naikon 2015]
Exact relationship: relationship--550bf43e-53da-467e-affd-9f44ad668508
S0062 DustySky — malware.
DustySky extracts basic information about the operating system.[DustySky]
Exact relationship: relationship--c008b7f3-0507-4987-a7e4-8c4d57cb4ca5
S0065 4H RAT — malware.
4H RAT sends an OS version identifier in its beacons.[CrowdStrike Putter Panda]
Exact relationship: relationship--27375058-3002-4fc2-a964-a1e336a10a2a
S0079 MobileOrder — malware.
MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.[Scarlet Mimic Jan 2016]
Exact relationship: relationship--a02da835-676d-47df-86c6-547a7d29dbae
S0081 Elise — malware.
Elise executes <code>systeminfo</code> after initial communication is made to the remote server.[Lotus Blossom Jun 2015]
Exact relationship: relationship--14135aaa-6080-48c1-8a08-d6ee9bb15c3d
S0082 Emissary — malware.
Emissary has the capability to execute ver and systeminfo commands.[Emissary Trojan Feb 2016]
Exact relationship: relationship--4a959425-4d43-4969-9a47-768894a3afaa
S0083 Misdat — malware.
The initial beacon packet for Misdat contains the operating system version of the victim.[Cylance Dust Storm]
Exact relationship: relationship--87e080cf-b8c0-4679-bcfb-ff77ab7698f3
S0084 Mis-Type — malware.
The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.[Cylance Dust Storm]
Exact relationship: relationship--aeda6707-50e2-47e2-833a-18e4a5d73e88
S0085 S-Type — malware.
The initial beacon packet for S-Type contains the operating system version and file system of the victim.[Cylance Dust Storm]
Exact relationship: relationship--7fbb56bf-cadd-4663-8067-f233d4c9c751
S0086 ZLib — malware.
ZLib has the ability to enumerate system information.[Cylance Dust Storm]
Exact relationship: relationship--3126c7fa-02eb-475f-a474-26d4d6af7a67
S0088 Kasidet — malware.
Kasidet has the ability to obtain a victim's system name and operating system version.[Zscaler Kasidet]
Exact relationship: relationship--49af09c8-1460-485d-9f09-dacea47fa016
S0089 BlackEnergy — malware.
BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.[F-Secure BlackEnergy 2014][Securelist BlackEnergy Nov 2014]
Exact relationship: relationship--efa98949-4b58-4407-8fa2-366c06dc2ed9
S0091 Epic — malware.
Epic collects the OS version, hardware information, computer name, available system memory status, and system and user language settings.[Kaspersky Turla Aug 2014]
Exact relationship: relationship--66b026b6-af1e-47a6-9c3d-b853e2130b68
S0093 Backdoor.Oldrea — malware.
Backdoor.Oldrea collects information about the OS and computer name.[Symantec Dragonfly][Gigamon Berserk Bear October 2021]
Exact relationship: relationship--f19234f6-5b59-4229-aae1-70df380a076a
S0094 Trojan.Karagany — malware.
Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.[Secureworks Karagany July 2019]
Exact relationship: relationship--5a415555-1367-47dd-9757-88a86430cf49
S0096 Systeminfo — tool.
Systeminfo can be used to gather information about the operating system.[TechNet Systeminfo]
Exact relationship: relationship--c088f23e-b741-453c-a710-01990dead853
S0098 T9000 — malware.
T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.[Palo Alto T9000 Feb 2016]
Exact relationship: relationship--487d67d7-b697-4de4-abde-decee8b17c44
S0105 dsquery — tool.
dsquery has the ability to enumerate various information, such as the operating system and host name, for systems within a domain.[Mandiant APT41]
Exact relationship: relationship--f9c5fdd4-4978-433f-a718-f8f512e13cac
S0106 cmd — tool.
cmd can be used to find information about the operating system.[TechNet Dir]
Exact relationship: relationship--745106bb-3641-488e-ae1c-547cd6ea9b7a
S0113 Prikormka — malware.
A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.[ESET Operation Groundbait]
Exact relationship: relationship--7adaf2f3-52f2-40aa-b1ae-2fd2f05d9d56
S0115 Crimson — malware.
Crimson contains a command to collect the victim PC name and operating system.[Proofpoint Operation Transparent Tribe March 2016][Kaspersky Transparent Tribe August 2020][Cisco Talos Transparent Tribe Education Campaign July 2022]
Exact relationship: relationship--4caf9f0d-dfe9-48ce-9b6e-812577e09711
S0124 Pisloader — malware.
Pisloader has a command to collect victim system information, including the system name and OS version.[Palo Alto DNS Requests]
Exact relationship: relationship--ed2e17b5-171b-4878-a3ab-2b70e8ca132a
S0125 Remsec — malware.
Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.[Kaspersky ProjectSauron Technical Analysis]
Exact relationship: relationship--9b36e877-e637-46b8-bdf1-def74c977472
S0130 Unknown Logger — malware.
Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.[Forcepoint Monsoon]
Exact relationship: relationship--02206f22-80e9-4f87-9e4b-5c1df1eb737e
S0137 CORESHELL — malware.
CORESHELL collects hostname and OS version data from the victim and sends the information to its C2 server.[FireEye APT28]
Exact relationship: relationship--5301c007-7c00-4b4d-b355-864db8de052f
S0139 PowerDuke — malware.
PowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.[Volexity PowerDuke November 2016]
Exact relationship: relationship--1fda6ff7-a344-4bc3-b545-4083cc15290d
S0140 Shamoon — malware.
Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.[Palo Alto Shamoon Nov 2016][Unit 42 Shamoon3 2018]
Exact relationship: relationship--272068a3-47e3-42d6-8772-71d39c1976c3
S0141 Winnti for Windows — malware.
Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.[Novetta Winnti April 2015]
Exact relationship: relationship--905c6670-b81e-40c1-b84d-8359ffc2dcc1
S0142 StreamEx — malware.
StreamEx has the ability to enumerate system information.[Cylance Shell Crew Feb 2017]
Exact relationship: relationship--788ca56e-1194-4c5f-a12b-72678390f1ef
S0144 ChChes — malware.
ChChes collects the victim hostname, window resolution, and Microsoft Windows version.[Palo Alto menuPass Feb 2017][PWC Cloud Hopper Technical Annex April 2017]
Exact relationship: relationship--a08dadbf-6f68-415f-9daa-f84571af83a2
S0148 RTM — malware.
RTM can obtain the computer name, OS version, and default language identifier.[ESET RTM Feb 2017]
Exact relationship: relationship--c6606ced-4641-451f-ac2a-493b1d15d0aa
S0149 MoonWind — malware.
MoonWind can obtain the victim hostname, Windows version, RAM amount, and screen resolution.[Palo Alto MoonWind March 2017]
Exact relationship: relationship--72fe5021-bace-41e4-9cc6-73af415225ac
S0151 HALFBAKED — malware.
HALFBAKED can obtain information about the OS, processor, and BIOS.[FireEye FIN7 April 2017]
Exact relationship: relationship--d6154157-fe69-4da3-8cc3-790eecf33f8c
S0153 RedLeaves — malware.
RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.[PWC Cloud Hopper Technical Annex April 2017][Accenture Hogfish April 2018]
Exact relationship: relationship--a8f11c39-df96-451e-a93a-417512f82819
S0155 WINDSHIELD — malware.
WINDSHIELD can gather the victim computer name.[FireEye APT32 May 2017]
Exact relationship: relationship--73fe447a-8d70-433f-be9a-5af74934a662
S0156 KOMPROGO — malware.
KOMPROGO is capable of retrieving information about the infected system.[FireEye APT32 May 2017]
Exact relationship: relationship--42dc03ec-03fb-4bf0-8f5f-e90d1aacd6e7
S0157 SOUNDBITE — malware.
SOUNDBITE is capable of gathering system information.[FireEye APT32 May 2017]
Exact relationship: relationship--5c4e0ddb-57a1-440f-82ab-146847c99be8
S0161 XAgentOSX — malware.
XAgentOSX contains the getInstalledAPP function to run <code>ls -la /Applications</code> to gather what applications are installed.[XAgentOSX 2017]
Exact relationship: relationship--ec362b37-1a64-4b28-8d34-7819d0aa5b2a
S0165 OSInfo — malware.
OSInfo discovers information about the infected machine.[Symantec Buckeye]
Exact relationship: relationship--7507eb37-407e-4428-b29f-da0bda3f7970
S0171 Felismus — malware.
Felismus collects the system information, including hostname and OS version, and sends it to the C2 server.[Forcepoint Felismus Mar 2017]
Exact relationship: relationship--9f653750-2ee6-4d00-906b-c71f1d217288
S0172 Reaver — malware.
Reaver collects system information from the victim, including CPU speed, computer name, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.[Palo Alto Reaver Nov 2017]
Exact relationship: relationship--edbd751e-29ad-419f-a3ff-9d210453351d
S0176 Wingbird — malware.
Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.[Microsoft SIR Vol 21]
Exact relationship: relationship--fe786b29-e621-48e2-84b5-aed35e6930fe
S0180 Volgmer — malware.
Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.[US-CERT Volgmer Nov 2017][US-CERT Volgmer 2 Nov 2017][Symantec Volgmer Aug 2014]
Exact relationship: relationship--35697909-4c19-4799-a5ac-3153750619f8
S0181 FALLCHILL — malware.
FALLCHILL can collect operating system (OS) version information, processor information, and system name from the victim.[US-CERT FALLCHILL Nov 2017]
Exact relationship: relationship--5dd257c0-c2cb-422a-9991-93ff667c5ad6
S0182 FinFisher — malware.
FinFisher checks if the victim OS is 32 or 64-bit.[FinFisher Citation][Microsoft FinFisher March 2018]
Exact relationship: relationship--db46b437-c406-4c36-a0fe-bf1f2c32a6fe
S0184 POWRUNER — malware.
POWRUNER may collect information about the system by running <code>hostname</code> and <code>systeminfo</code> on a victim.[FireEye APT34 Dec 2017]
Exact relationship: relationship--a88332d2-d03f-4139-b11c-19e82459189b
S0186 DownPaper — malware.
DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.[ClearSky Charming Kitten Dec 2017]
Exact relationship: relationship--396edbf6-41b5-4377-90b6-4967c24de7fb
S0192 Pupy — tool.
Pupy can grab a system’s information including the OS version, architecture, etc.[GitHub Pupy]
Exact relationship: relationship--7e2a1dfa-1ccd-4700-a4a5-3b98590ae710
S0196 PUNCHBUGGY — malware.
PUNCHBUGGY can gather system information such as computer names.[Morphisec ShellTea June 2019]
Exact relationship: relationship--ec85433f-2635-4e7c-af49-6dbfb269dbbd
S0198 NETWIRE — malware.
NETWIRE can discover and collect victim system information.[McAfee Netwire Mar 2015]
Exact relationship: relationship--e2e35a7a-3057-4955-9e7e-c3972e0ad423
S0199 TURNEDUP — malware.
TURNEDUP is capable of gathering system information.[FireEye APT33 Sept 2017]
Exact relationship: relationship--9ee2a9f3-9174-4927-8561-56d5c6723b9e
S0201 JPIN — malware.
JPIN can obtain system information such as OS version and disk space.[Microsoft PLATINUM April 2016]
Exact relationship: relationship--ad39bd23-1dd8-4725-bf00-74c0e564215f
S0203 Hydraq — malware.
Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.[Symantec Hydraq Jan 2010]
Exact relationship: relationship--4be87979-faf9-4a7a-998a-d1aa3fbf5a80
S0205 Naid — malware.
Naid collects a unique identifier (UID) from a compromised host.[Symantec Naid June 2012]
Exact relationship: relationship--70e81cc7-9dd6-4349-b7ab-212a46591cff
S0208 Pasam — malware.
Pasam creates a backdoor through which remote attackers can retrieve information like hostname.[Symantec Pasam May 2012]
Exact relationship: relationship--c5087d19-7d99-4106-9dc7-407c7de710be
S0211 Linfo — malware.
Linfo creates a backdoor through which remote attackers can retrieve system information.[Symantec Linfo May 2012]
Exact relationship: relationship--05104256-7e9a-457b-8e9f-86976992f3c7
S0214 HAPPYWORK — malware.
can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.[FireEye APT37 Feb 2018]
Exact relationship: relationship--67ffaecc-e47d-47a1-93fd-82d21018ad8b
S0215 KARAE — malware.
KARAE can collect system information.[FireEye APT37 Feb 2018]
Exact relationship: relationship--87406432-7190-4606-980b-441819713d1d
S0216 POORAIM — malware.
POORAIM can identify system information, including battery status.[FireEye APT37 Feb 2018]
Exact relationship: relationship--f14c6ecd-4997-44aa-9d29-232195fd4a82
S0217 SHUTTERSPEED — malware.
SHUTTERSPEED can collect system information.[FireEye APT37 Feb 2018]
Exact relationship: relationship--42ce3f19-e995-4a9e-b7d6-74a5a28824f9
S0218 SLOWDRIFT — malware.
SLOWDRIFT collects and sends system information to its C2.[FireEye APT37 Feb 2018]
Exact relationship: relationship--128eb6e8-d1a7-4ff6-85e6-a68cfea3298e
S0219 WINERACK — malware.
WINERACK can gather information about the host.[FireEye APT37 Feb 2018]
Exact relationship: relationship--ed1aa5fa-7f0e-4d87-b3f5-7b50ab01e34b
S0223 POWERSTATS — malware.
POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.[FireEye MuddyWater Mar 2018][TrendMicro POWERSTATS V3 June 2019]
Exact relationship: relationship--4e88ec20-d309-440d-a685-0d2abdc1d7ef
S0228 NanHaiShu — malware.
NanHaiShu can gather the victim computer name and serial number.[Proofpoint Leviathan Oct 2017]
Exact relationship: relationship--ec3f88b1-ba85-497f-91d0-3eb8dcc5c4f1
S0229 Orz — malware.
Orz can gather the victim OS version and whether it is 64 or 32 bit.[Proofpoint Leviathan Oct 2017]
Exact relationship: relationship--23d16034-a2eb-40ef-857b-63708e63bf9a
S0230 ZeroT — malware.
ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.[Proofpoint ZeroT Feb 2017]
Exact relationship: relationship--7bb2d594-36dc-458d-9f9b-8a3df42fac67
S0233 MURKYTOP — malware.
MURKYTOP has the capability to retrieve information about the OS.[FireEye Periscope March 2018]
Exact relationship: relationship--231dc643-8b22-4a24-83f2-7327a1c5bd13
S0236 Kwampirs — malware.
Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands <code>systeminfo</code>, <code>net config workstation</code>, <code>hostname</code>, <code>ver</code>, <code>set</code>, and <code>date /t</code>.[Symantec Orangeworm April 2018]
Exact relationship: relationship--a8dc6cca-3ede-4110-baf1-8ce53fb655a9
S0237 GravityRAT — malware.
GravityRAT collects the MAC address, computer name, and CPU information.[Talos GravityRAT]
Exact relationship: relationship--041e8f9b-6cdb-44b3-aa37-a274a4de9a0b
S0238 Proxysvc — malware.
Proxysvc collects the OS version, country name, MAC address, computer name, and physical memory statistics.[McAfee GhostSecret]
Exact relationship: relationship--960bdedf-dcca-4a9b-aa12-358324565470
S0239 Bankshot — malware.
Bankshot gathers system information, network addresses, and the operation system version.[McAfee Bankshot][US-CERT Bankshot Dec 2017]
Exact relationship: relationship--55de5c21-4cb1-4235-89b5-df77dfc7fa90
S0240 ROKRAT — malware.
ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.[Talos ROKRAT][Talos ROKRAT 2][Securelist ScarCruft May 2019][NCCGroup RokRat Nov 2018][Volexity InkySquid RokRAT August 2021][Malwarebytes RokRAT VBA January 2021]
Exact relationship: relationship--cfc92bbe-4a8b-47ec-b12d-d08fdcea1fbb
S0241 RATANKBA — malware.
RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.[Lazarus RATANKBA][RATANKBA]
Exact relationship: relationship--f3e4b47e-cde3-4f27-85b7-464b02325ee6
S0242 SynAck — malware.
SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.[SecureList SynAck Doppelgänging May 2018]
Exact relationship: relationship--3e58118d-64b9-43ae-bfd8-cb3c8bf19556
S0244 Comnie — malware.
Comnie collects the hostname of the victim machine.[Palo Alto Comnie]
Exact relationship: relationship--b22e151c-4919-4160-9f5c-143484948003
S0245 BADCALL — malware.
BADCALL collects the computer name and host name on the compromised system.[US-CERT BADCALL]
Exact relationship: relationship--8840d33c-de12-45d5-a0e3-cdfddf789794
S0247 NavRAT — malware.
NavRAT uses <code>systeminfo</code> on a victim’s machine.[Talos NavRAT May 2018]
Exact relationship: relationship--8a00aa55-b7b2-4df5-902b-d01bfdf89089
S0248 yty — malware.
yty gathers the computer name, CPU information, Microsoft Windows version, and runs the command <code>systeminfo</code>.[ASERT Donot March 2018]
Exact relationship: relationship--abf00a6a-7922-432c-95e0-6c44db2c20e3
S0249 Gold Dragon — malware.
Gold Dragon collects endpoint information using the <code>systeminfo</code> command.[McAfee Gold Dragon]
Exact relationship: relationship--c1544dec-4586-466a-b730-862c06e9e3c7
S0250 Koadic — tool.
Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.[MalwareBytes LazyScripter Feb 2021]
Exact relationship: relationship--055261fd-70cd-49c6-b9e6-2641bae4dda7
S0251 Zebrocy — malware.
Zebrocy collects the OS version and computer name. Zebrocy also runs the <code>systeminfo</code> command to gather system information. [Palo Alto Sofacy 06-2018][Unit42 Cannon Nov 2018][ESET Zebrocy Nov 2018][Unit42 Sofacy Dec 2018][ESET Zebrocy May 2019][Accenture SNAKEMACKEREL Nov 2018][CISA Zebrocy Oct 2020]
Exact relationship: relationship--6216dadc-095e-4550-bc01-79c79fe614ba
S0252 Brave Prince — malware.
Brave Prince collects hard drive content and system configuration information.[McAfee Gold Dragon]
Exact relationship: relationship--0f66681a-7daf-4cd7-99af-3005b6586306
S0253 RunningRAT — malware.
RunningRAT gathers the OS version and processor information.[McAfee Gold Dragon]
Exact relationship: relationship--b1c307de-b924-4332-b8db-3c371e46430e
S0254 PLAINTEE — malware.
PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.[Rancor Unit42 June 2018]
Exact relationship: relationship--072af62a-85d5-4803-aa05-d7c6efa9ec2a
S0257 VERMIN — malware.
VERMIN collects the OS name, machine name, and architecture information.[Unit 42 VERMIN Jan 2018]
Exact relationship: relationship--eade28d3-c5ce-453e-8e57-3262167c30be
S0259 InnaputRAT — malware.
InnaputRAT gathers system information.[ASERT InnaputRAT April 2018]
Exact relationship: relationship--32e93dd8-d0df-40d8-b85f-e10e70fc0b8f
S0260 InvisiMole — malware.
InvisiMole can gather information on the OS version, computer name, DEP policy, and memory size.[ESET InvisiMole June 2018][ESET InvisiMole June 2020]
Exact relationship: relationship--9154afb8-abf6-4d9d-b114-5106d801338f
S0262 QuasarRAT — tool.
QuasarRAT can gather system information from the victim’s machine including the OS type.[GitHub QuasarRAT]
Exact relationship: relationship--48281b5d-ca6f-401e-bda1-24f6537dcf1d
S0264 OopsIE — malware.
OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.[Unit 42 OilRig Sept 2018]
Exact relationship: relationship--6a289837-2455-471b-81e4-b677550ab77b
S0265 Kazuar — malware.
Kazuar gathers information on the system.[Unit 42 Kazuar May 2017]
Exact relationship: relationship--8bbf259b-029b-48fa-859b-5dbbbcd98b53
S0266 TrickBot — malware.
TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.[S2 Grupo TrickBot June 2017][Fidelis TrickBot Oct 2016][Cyberreason Anchor December 2019][Eclypsium Trickboot December 2020]
Exact relationship: relationship--01aac35b-55e1-40d6-962f-5b5a6efdb2be
S0267 FELIXROOT — malware.
FELIXROOT collects the victim’s computer name, processor architecture, OS version, and system type.[FireEye FELIXROOT July 2018][ESET GreyEnergy Oct 2018]
Exact relationship: relationship--4bd74c6c-9e4f-4048-b968-13319d68ff00
S0268 Bisonal — malware.
Bisonal has used commands and API calls to gather system information.[Unit 42 Bisonal July 2018][Kaspersky CactusPete Aug 2020][Talos Bisonal Mar 2020]
Exact relationship: relationship--ced766d2-ca63-43d2-8551-76f37696cc88
S0270 RogueRobin — malware.
RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.[Unit 42 DarkHydrus July 2018]
Exact relationship: relationship--d8bad886-d65a-4652-811f-f8ff9f6bb6db
S0271 KEYMARBLE — malware.
KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, and time elapsed since system start.[US-CERT KEYMARBLE Aug 2018]
Exact relationship: relationship--5823e4cd-e6cb-4e62-8ed2-a0f296128d34
S0272 NDiskMonitor — malware.
NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.[TrendMicro Patchwork Dec 2017]
Exact relationship: relationship--7a8a36ee-66f8-42ca-abeb-29e6223b91ee
S0275 UPPERCUT — malware.
UPPERCUT has the capability to gather the system’s hostname and OS version.[FireEye APT10 Sept 2018][Trend Micro Earth Kasha Anel NOV 2024]
Exact relationship: relationship--90355089-e793-4a6a-98b4-c1f20322a98f
S0280 MirageFox — malware.
MirageFox can collect CPU and architecture information from the victim’s machine.[APT15 Intezer June 2018]
Exact relationship: relationship--47b7e027-4208-4ed6-b4ae-46941fed16be
S0283 jRAT — malware.
jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.[Symantec Frutas Feb 2013]
Exact relationship: relationship--4e6c5e8c-96a2-4da8-869a-56fe224e037e
S0284 More_eggs — malware.
More_eggs has the capability to gather the OS version and computer name.[Talos Cobalt Group July 2018][Security Intelligence More Eggs Aug 2019]
Exact relationship: relationship--100f4917-1702-4707-bd9f-58d471e77018
S0330 Zeus Panda — malware.
Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.[Talos Zeus Panda Nov 2017][GDATA Zeus Panda June 2017]
Exact relationship: relationship--dac8dcfd-e7e7-4b41-b100-07f95f6b0ba9
S0331 Agent Tesla — malware.
Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.[Fortinet Agent Tesla April 2018][Fortinet Agent Tesla June 2017][Malwarebytes Agent Tesla April 2020]
Exact relationship: relationship--b509e591-b086-4631-a9ba-5a5dc80de8d0
S0332 Remcos — tool.
Remcos can collect the OS version and process architecture of compromised hosts.[Fortinet Remcos Campaign NOV 2024]
Exact relationship: relationship--2147037d-4af2-4492-9c86-c85dfc6965af
S0334 DarkComet — malware.
DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.[TrendMicro DarkComet Sept 2014][Malwarebytes DarkComet March 2018]
Exact relationship: relationship--62442f37-7a0e-4945-b498-2d02306e53c7
S0337 BadPatch — malware.
BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.[Unit 42 BadPatch Oct 2017]
Exact relationship: relationship--520faa7e-f529-4b54-b4dc-55d6ae094717
S0339 Micropsia — malware.
Micropsia gathers the hostname and OS version from the victim’s machine.[Talos Micropsia June 2017][Radware Micropsia July 2018]
Exact relationship: relationship--002c9202-d7a0-4181-b912-42f7d6d38339
S0340 Octopus — malware.
Octopus can collect the computer name, OS version, and OS architecture information.[Securelist Octopus Oct 2018]
Exact relationship: relationship--75a1f636-76d3-4029-ae40-0a7a3b8d7eba
S0344 Azorult — malware.
Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.[Unit42 Azorult Nov 2018][Proofpoint Azorult July 2018]
Exact relationship: relationship--e391c03a-9ef4-436f-8ab5-2c15168c9551
S0346 OceanSalt — malware.
OceanSalt can collect the computer name from the system.[McAfee Oceansalt Oct 2018]
Exact relationship: relationship--88d53468-4ab8-455e-bd16-dc52ef9a3d96
S0348 Cardinal RAT — malware.
Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.[PaloAlto CardinalRat Apr 2017]
Exact relationship: relationship--c50c585a-b5c4-41c7-91a2-b6bb14b7e1f0
S0350 zwShell — malware.
zwShell can obtain the victim PC name and OS version.[McAfee Night Dragon]
Exact relationship: relationship--5f179b5c-497f-42da-bc32-360b6113122b
S0351 Cannon — malware.
Cannon can gather system information from the victim’s machine such as the OS version, and machine name.[Unit42 Cannon Nov 2018][Unit42 Sofacy Dec 2018]
Exact relationship: relationship--f9bf12c3-7512-47fe-86d7-cc89662abad4
S0352 OSX_OCEANLOTUS.D — malware.
OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the <code>ioreg</code> command to gather some of this information.[TrendMicro MacOS April 2018][Trend Micro MacOS Backdoor November 2020][20 macOS Common Tools and Techniques]
Exact relationship: relationship--588865e4-caec-4150-9c03-df5e28eb9c79
S0353 NOKKI — malware.
NOKKI can gather information on the operating system on the victim’s machine.[Unit 42 NOKKI Sept 2018]
Exact relationship: relationship--ef6d08c0-e9dd-45e1-b5ce-42cd5731f2ab
S0354 Denis — malware.
Denis collects OS information and the computer name from the victim’s machine.[Securelist Denis April 2017][Cybereason Cobalt Kitty 2017]
Exact relationship: relationship--2910f5f5-38d6-418a-8566-23d31b93b124
S0355 Final1stspy — malware.
Final1stspy obtains victim Microsoft Windows version information and CPU architecture.[Unit 42 Nokki Oct 2018]
Exact relationship: relationship--854fd292-dbaf-4112-96b2-824364c82a4c
S0356 KONNI — malware.
KONNI can gather the OS version, architecture information, hostname, and RAM size information from the victim’s machine and has used <code>cmd /c systeminfo</code> command to get a snapshot of the current system state of the target machine.[Talos Konni May 2017][Medium KONNI Jan 2020][Malwarebytes Konni Aug 2021]
Exact relationship: relationship--172da5b1-cf68-468a-8208-b15ea5c813dc
S0363 Empire — tool.
Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.[Github PowerShell Empire][Talos Frankenstein June 2019]
Exact relationship: relationship--3c766e53-1372-4b94-b7de-b3f70d4d1a91
S0373 Astaroth — malware.
Astaroth collects the machine name and keyboard language from the system. [Cofense Astaroth Sept 2018][Cybereason Astaroth Feb 2019]
Exact relationship: relationship--29d3798c-dc27-4950-abc4-30b48608a746
S0374 SpeakUp — malware.
SpeakUp uses the <code>cat /proc/cpuinfo | grep -c “cpu family” 2>&1</code> command to gather system information. [CheckPoint SpeakUp Feb 2019]
Exact relationship: relationship--0a8c04f1-c724-4215-92f0-3863b2a3d96d
S0376 HOPLIGHT — malware.
HOPLIGHT has been observed collecting victim machine information like OS version.[US-CERT HOPLIGHT Apr 2019]
Exact relationship: relationship--7aeee346-4272-45c4-b351-1cf4ac98a15d
S0378 PoshC2 — tool.
PoshC2 contains modules, such as <code>Get-ComputerInfo</code>, for enumerating common system information.[GitHub PoshC2]
Exact relationship: relationship--59fe8c5d-f008-4be7-a187-39d70073914d
S0379 Revenge RAT — malware.
Revenge RAT collects the CPU information, OS information, and system language.[Cylance Shaheen Nov 2018]
Exact relationship: relationship--6765828a-168f-4dd7-8c1b-00f7d98daef5
S0380 StoneDrill — malware.
StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.[Kaspersky StoneDrill 2017]
Exact relationship: relationship--9497e927-67da-4845-b7a9-fe7d13524110
S0381 FlawedAmmyy — malware.
FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.[Proofpoint TA505 Mar 2018]
Exact relationship: relationship--0d95b411-1192-42d0-96b1-98fe18742a04
S0382 ServHelper — malware.
ServHelper will attempt to enumerate Windows version and system architecture.[Proofpoint TA505 Jan 2019]
Exact relationship: relationship--5faa7f83-062b-4821-ad9b-b731a41c06d9
S0384 Dridex — malware.
Dridex has collected the computer name and OS architecture information from the system.[Checkpoint Dridex Jan 2021]
Exact relationship: relationship--9dfb9740-1641-4306-8ee8-38318be3ae42
S0385 njRAT — malware.
njRAT enumerates the victim operating system and computer name during the initial infection.[Fidelis njRAT June 2013]
Exact relationship: relationship--005cbf7d-9d0b-443b-91db-7b148a1eb55b
S0386 Ursnif — malware.
Ursnif has used Systeminfo to gather system information.[TrendMicro Ursnif Mar 2015]
Exact relationship: relationship--b892d69f-bdfc-48e8-83f5-3081b9bffa4a
S0387 KeyBoy — malware.
KeyBoy can gather extended system information, such as information about the operating system and memory.[PWC KeyBoys Feb 2017][Rapid7 KeyBoy Jun 2013]
Exact relationship: relationship--0bc7c262-604c-42af-8829-ce9f579436d4
S0388 YAHOYAH — malware.
YAHOYAH checks for the system’s Windows OS version and hostname.[TrendMicro TropicTrooper 2015]
Exact relationship: relationship--01c60a20-2eff-4b4e-a15a-24e56a487b4e
S0391 HAWKBALL — malware.
HAWKBALL can collect the OS version, architecture information, and computer name.[FireEye HAWKBALL Jun 2019]
Exact relationship: relationship--3dbae391-a354-488a-b0ab-426d1a055413
S0395 LightNeuron — malware.
LightNeuron gathers the victim computer name using the Win32 API call <code>GetComputerName</code>.[ESET LightNeuron May 2019]
Exact relationship: relationship--70f5df58-30d0-4866-bfee-64dcf10edca9
S0402 OSX/Shlayer — malware.
OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command <code>sw_vers -productVersion</code>.[Carbon Black Shlayer Feb 2019][sentinelone shlayer to zshlayer]
Exact relationship: relationship--9db842bf-d65d-44a8-93ca-aef62cadafc1
S0409 Machete — malware.
Machete collects the hostname of the target computer.[ESET Machete July 2019]
Exact relationship: relationship--d843c014-0814-4945-b75a-09db4ad6e81b
S0410 Fysbis — malware.
Fysbis has used the command <code>ls /etc | egrep -e"fedora\*|debian\*|gentoo\*|mandriva\*|mandrake\*|meego\*|redhat\*|lsb-\*|sun-\*|SUSE\*|release"</code> to determine which Linux OS version is running.[Fysbis Palo Alto Analysis]
Exact relationship: relationship--834bbbc7-33b7-41e4-9bc8-98401a5a0e36
S0412 ZxShell — malware.
ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.[Talos ZxShell Oct 2014]
Exact relationship: relationship--20f422e8-6244-46e3-8842-f5dc3e37568c
S0414 BabyShark — malware.
BabyShark has executed the <code>ver</code> command.[Unit42 BabyShark Feb 2019]
Exact relationship: relationship--906699ff-a10f-4527-9173-326965cc51a2
S0417 GRIFFON — malware.
GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .[SecureList Griffon May 2019]
Exact relationship: relationship--66bd7bd5-b53f-4791-a130-7278541f3fa7
S0428 PoetRAT — malware.
PoetRAT has the ability to gather information about the compromised host.[Talos PoetRAT April 2020]
Exact relationship: relationship--77d954c5-de84-4f4b-98b6-5ad35603ae7a
S0431 HotCroissant — malware.
HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.[US-CERT HOTCROISSANT February 2020]
Exact relationship: relationship--e3542e4e-6c4d-468a-b11e-462e35dc33f6
S0433 Rifdoor — malware.
Rifdoor has the ability to identify the Windows version on the compromised host.[Carbon Black HotCroissant April 2020]
Exact relationship: relationship--0d557837-8936-43e7-95fd-2c30938d34d3
S0439 Okrum — malware.
Okrum can collect computer name, locale information, and information about the OS and architecture.[ESET Okrum July 2019]
Exact relationship: relationship--702ed555-03e2-4660-82d8-e85d46cbec02
S0441 PowerShower — malware.
PowerShower has collected system information on the infected host.[Unit 42 Inception November 2018]
Exact relationship: relationship--175199ba-b8b8-467b-9010-a2f549abd957
S0445 ShimRatReporter — tool.
ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.[FOX-IT May 2016 Mofang]
Exact relationship: relationship--c62b3e99-4ab2-4474-b3f7-2779652210f7
S0447 Lokibot — malware.
Lokibot has the ability to discover the computer name and Windows product name/version.[FSecure Lokibot November 2019]
Exact relationship: relationship--a9e6a51e-69b1-4b21-9db1-5aabdded2f0a
S0448 Rising Sun — malware.
Rising Sun can detect the computer name and operating system.[McAfee Sharpshooter December 2018]
Exact relationship: relationship--5bd827b4-cdaf-4d50-acb8-493f32d51acb
S0449 Maze — malware.
Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.[McAfee Maze March 2020]
Exact relationship: relationship--0d3f773c-ed0e-4db4-8457-204a7a33eb58
S0450 SHARPSTATS — malware.
SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.[TrendMicro POWERSTATS V3 June 2019]
Exact relationship: relationship--de70abfa-848f-4993-bdb8-7235d4a3d720
S0451 LoudMiner — malware.
LoudMiner has monitored CPU usage.[ESET LoudMiner June 2019]
Exact relationship: relationship--9e339696-4e81-496f-808e-82d63b62c331
S0453 Pony — malware.
Pony has collected the Service Pack, language, and region information to send to the C2.[Malwarebytes Pony April 2016]
Exact relationship: relationship--8dd83463-b0cb-46e9-a01a-b22c6780066f
S0454 Cadelspy — malware.
Cadelspy has the ability to discover information about the compromised host.[Symantec Chafer Dec 2015]
Exact relationship: relationship--d826904c-7853-4f85-a5e4-948b21ae374c
S0455 Metamorfo — malware.
Metamorfo has collected the hostname and operating system version from the compromised host.[FireEye Metamorfo Apr 2018][Fortinet Metamorfo Feb 2020][ESET Casbaneiro Oct 2019]
Exact relationship: relationship--8a8afe63-a754-40e3-98af-cfc3f0aa6ef5
S0456 Aria-body — malware.
Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, and machine GUID on a compromised host.[CheckPoint Naikon May 2020]
Exact relationship: relationship--5fdd0fba-8d1d-411a-b47b-3e5aae512892
S0457 Netwalker — malware.
Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.[TrendMicro Netwalker May 2020]
Exact relationship: relationship--1c3bc7ec-cabe-4c8f-9d6e-99afd877e845
S0460 Get2 — malware.
Get2 has the ability to identify the computer name and Windows version of an infected host.[Proofpoint TA505 October 2019]
Exact relationship: relationship--9c4281ea-b225-44b4-b460-255e51586598
S0461 SDBbot — malware.
SDBbot has the ability to identify the OS version, OS bit information and computer name.[Proofpoint TA505 October 2019][Korean FSI TA505 2020]
Exact relationship: relationship--855bcd64-ef37-4197-8d3e-2c147d42d774
S0462 CARROTBAT — malware.
CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.[Unit 42 CARROTBAT November 2018][Unit 42 CARROTBAT January 2020]
Exact relationship: relationship--0b37289c-b118-45f7-98b2-5efe06cbf0b2
S0464 SYSCON — malware.
SYSCON has the ability to use Systeminfo to identify system information.[Unit 42 CARROTBAT January 2020]
Exact relationship: relationship--01ebd689-8233-409a-a12d-eafb2546f665
S0467 TajMahal — malware.
TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.[Kaspersky TajMahal April 2019]
Exact relationship: relationship--179538d1-5770-42ef-976f-c0fd65faa1ea
S0468 Skidmap — malware.
Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.[Trend Micro Skidmap]
Exact relationship: relationship--709d0737-e2ac-4ce3-9772-0dbc06f9667e
S0473 Avenger — malware.
Avenger has the ability to identify the OS architecture on a compromised host.[Trend Micro Tick November 2019]
Exact relationship: relationship--fc4c0c44-2e94-47c1-9174-fcf0fa1a80b4
S0475 BackConfig — malware.
BackConfig has the ability to gather the victim's computer name.[Unit 42 BackConfig May 2020]
Exact relationship: relationship--8763c8dd-cd68-4402-be43-4dbd96c83c2d
S0476 Valak — malware.
Valak can determine the Windows version and computer name on a compromised host.[Cybereason Valak May 2020][SentinelOne Valak June 2020]
Exact relationship: relationship--7b4e1a93-99ca-444d-bfc4-bc589a9a25a9
S0482 Bundlore — malware.
Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using <code>/usr/bin/sw_vers -productVersion</code>.[MacKeeper Bundlore Apr 2019][20 macOS Common Tools and Techniques]
Exact relationship: relationship--132c7780-3fa4-478b-b037-f2c1ad99d98f
S0483 IcedID — malware.
IcedID has the ability to identify the computer name and OS version on a compromised host.[IBM IcedID November 2017][DFIR_Quantum_Ransomware]
Exact relationship: relationship--f36f0a5d-a2a6-440f-8d6f-3fbdafb07af0
S0484 Carberp — malware.
Carberp has collected the operating system version from the infected system.[Prevx Carberp March 2011]
Exact relationship: relationship--dacff5f4-a7ed-424b-847b-377ed2b91679
S0486 Bonadan — malware.
Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.[ESET ForSSHe December 2018]
Exact relationship: relationship--34775b6e-f7dd-4b0f-bbb4-c696bfbda1c2
S0487 Kessel — malware.
Kessel has collected the system architecture, OS version, and MAC address information.[ESET ForSSHe December 2018]
Exact relationship: relationship--6e9c79b0-9b63-4785-be48-033ab5f55a18
S0493 GoldenSpy — malware.
GoldenSpy has gathered operating system information.[Trustwave GoldenSpy June 2020]
Exact relationship: relationship--1489f01c-fe49-4332-99e2-d72c487403b6
S0496 REvil — malware.
REvil can identify the username, machine name, system language, keyboard layout, and OS version on a compromised host.[Kaspersky Sodin July 2019][Cylance Sodinokibi July 2019][Secureworks GandCrab and REvil September 2019][McAfee Sodinokibi October 2019][McAfee Sodinokibi October 2019][Intel 471 REvil March 2020][Group IB Ransomware May 2020][Secureworks REvil September 2019]
Exact relationship: relationship--598d55da-c5f9-447c-acad-0c611f1deda0
S0501 PipeMon — malware.
PipeMon can collect and send OS version and computer name as a part of its C2 beacon.[ESET PipeMon May 2020]
Exact relationship: relationship--270c93ba-a3d4-4ace-8fad-691c64c13e2f
S0504 Anchor — malware.
Anchor can determine the hostname and linux version on a compromised host.[Medium Anchor DNS July 2020]
Exact relationship: relationship--23c89ec7-3407-4f6d-8b4b-0ab16fbf356c
S0512 FatDuke — malware.
FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.[ESET Dukes October 2019]
Exact relationship: relationship--4f5fd1ed-a91e-4a9e-b2e8-6c45cc31e065
S0513 LiteDuke — malware.
LiteDuke can enumerate the CPUID and BIOS version on a compromised system.[ESET Dukes October 2019]
Exact relationship: relationship--137ce702-f0e6-4dfa-8ca5-439155d91af9
S0514 WellMess — malware.
WellMess can identify the computer name of a compromised host.[PWC WellMess July 2020][CISA WellMess July 2020]
Exact relationship: relationship--5e967f56-9186-43d5-b748-4ee383df4174
S0516 SoreFang — malware.
SoreFang can collect the hostname, operating system configuration, and product ID on victim machines by executing Systeminfo.[CISA SoreFang July 2016]
Exact relationship: relationship--75e01f6a-9f45-4db2-a79d-a21453b6d83f
S0520 BLINDINGCAN — malware.
BLINDINGCAN has collected from a victim machine the system name, processor information, and OS version.[US-CERT BLINDINGCAN Aug 2020]
Exact relationship: relationship--11ed4654-a7bf-4063-9452-6d6174b9f8bc
S0531 Grandoreiro — malware.
Grandoreiro can collect the computer name and OS version from a compromised host.[ESET Grandoreiro April 2020]
Exact relationship: relationship--68fc9cf1-d191-4ebd-af14-004519ab76d7
S0532 Lucifer — malware.
Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.[Unit 42 Lucifer June 2020]
Exact relationship: relationship--aecb4057-07a2-4b44-805a-5566a4047e23
S0533 SLOTHFULMEDIA — malware.
SLOTHFULMEDIA has collected system name, OS version, adapter information, and memory usage from a victim machine.[CISA MAR SLOTHFULMEDIA October 2020]
Exact relationship: relationship--f8a9e39a-0038-437c-96ad-4408d028dd86
S0534 Bazar — malware.
Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.[Cybereason Bazar July 2020][NCC Group Team9 June 2020]
Exact relationship: relationship--f6f600fd-796d-4f1f-b2c6-0ca283b2cdb1
S0543 Spark — malware.
Spark can collect the hostname, keyboard layout, and language from the system.[Unit42 Molerat Mar 2020]
Exact relationship: relationship--7f659555-cfc4-420f-8548-3a89aa1da8c9
S0546 SharpStage — malware.
SharpStage has checked the system settings to see if Arabic is the configured language.[BleepingComputer Molerats Dec 2020]
Exact relationship: relationship--9e85e741-0dcd-4a15-a35a-a920f46824c2
S0547 DropBook — malware.
DropBook has checked for the presence of Arabic language in the infected machine's settings.[Cybereason Molerats Dec 2020]
Exact relationship: relationship--e11c02c8-e740-489f-925f-33c05c94c80f
S0553 MoleNet — malware.
MoleNet can collect information about the about the system.[Cybereason Molerats Dec 2020]
Exact relationship: relationship--01b542b1-3222-459b-9cdf-b91dcd29c749
S0554 Egregor — malware.
Egregor can perform a language check of the infected system and can query the CPU information (cupid).[JoeSecurity Egregor 2020][NHS Digital Egregor Nov 2020]
Exact relationship: relationship--f0a74237-9a46-4ea8-a268-3ac87f593ea9
S0556 Pay2Key — malware.
Pay2Key has the ability to gather the hostname of the victim machine.[Check Point Pay2Key November 2020]
Exact relationship: relationship--85b17ee3-cd16-4f7d-bfaa-23e756f344d5
S0559 SUNBURST — malware.
SUNBURST collected hostname and OS version.[FireEye SUNBURST Backdoor December 2020][Microsoft Analyzing Solorigate Dec 2020]
Exact relationship: relationship--142afe71-581e-415e-9867-97ac0aaded65
S0567 Dtrack — malware.
Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.[Securelist Dtrack][CyberBit Dtrack]
Exact relationship: relationship--1b47deed-a8b9-4e0f-a47e-9570ecccaa90
S0568 EVILNUM — malware.
EVILNUM can obtain the computer name from the victim's system.[Prevailion EvilNum May 2020]
Exact relationship: relationship--3ff46c64-10c7-474c-86eb-c66f1f85f5ac
S0569 Explosive — malware.
Explosive has collected the computer name from the infected host.[CheckPoint Volatile Cedar March 2015]
Exact relationship: relationship--c0220333-2cfb-4449-acbb-9bea0b7751b4
S0572 Caterpillar WebShell — malware.
Caterpillar WebShell has a module to gather information from the compromised asset, including the computer version, computer name, IIS version, and more.[ClearSky Lebanese Cedar Jan 2021]
Exact relationship: relationship--b844919a-e7d8-4317-9f0d-56338bae818c
S0584 AppleJeus — malware.
AppleJeus has collected the victim host information after infection.[CISA AppleJeus Feb 2021]
Exact relationship: relationship--70c29cd1-53a2-48a6-8f94-515e7812013b
S0585 Kerrdown — malware.
Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.[Unit 42 KerrDown February 2019]
Exact relationship: relationship--7727f1e9-4914-4512-a319-3e5758c47602
S0587 Penquin — malware.
Penquin can report the file system type of a compromised host to C2.[Leonardo Turla Penquin May 2020]
Exact relationship: relationship--e2b67455-4986-46f4-a4ff-f5ee215ef998
S0596 ShadowPad — malware.
ShadowPad has discovered system information including memory status, CPU frequency, and OS versions.[Kaspersky ShadowPad Aug 2017]
Exact relationship: relationship--d216c395-ceb2-4103-8035-336a0821b79c
S0601 Hildegard — malware.
Hildegard has collected the host's OS, CPU, and memory information.[Unit 42 Hildegard Malware]
Exact relationship: relationship--810630f3-01fb-416d-992c-3f5a0390d962
S0603 Stuxnet — malware.
Stuxnet collects system information including computer and domain names, OS version, and S7P paths.[Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]
Exact relationship: relationship--061cfa7a-df09-40cc-bed5-35407b425cb8
S0604 Industroyer — malware.
Industroyer collects the victim machine’s Windows GUID.[Dragos Crashoverride 2017]
Exact relationship: relationship--d0592d8b-cb1e-431f-a27e-1412892ca030
S0610 SideTwist — malware.
SideTwist can collect the computer name of a targeted system.[Check Point APT34 April 2021]
Exact relationship: relationship--d68f3474-8ba0-45e8-8876-3b1dd8a56fbf
S0615 SombRAT — malware.
SombRAT can execute <code>getinfo</code> to enumerate the computer name and OS version of a compromised system.[BlackBerry CostaRicto November 2020]
Exact relationship: relationship--ff3ade9d-2665-4794-bb1e-cb436d790f3f
S0622 AppleSeed — malware.
AppleSeed can identify the OS version of a targeted system.[Malwarebytes Kimsuky June 2021]
Exact relationship: relationship--7920e962-00d7-4eb0-a94d-ed1ca196cd50
S0627 SodaMaster — malware.
SodaMaster can enumerate the host name and OS version on a target system.[Securelist APT10 March 2021]
Exact relationship: relationship--695e51bb-e410-40b1-b8fc-d40734796729
S0631 Chaes — malware.
Chaes has collected system information, including the machine name and OS version.[Cybereason Chaes Nov 2020]
Exact relationship: relationship--ee466042-fd08-4c86-898d-63fc5d4ed1d6
S0632 GrimAgent — malware.
GrimAgent can collect the OS, and build version on a compromised host.[Group IB GrimAgent July 2021]
Exact relationship: relationship--eed367b8-b1d1-492e-a376-6725b6db7103
S0634 EnvyScout — malware.
EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.[MSTIC Nobelium Toolset May 2021]
Exact relationship: relationship--055a15db-2f5b-4c61-821e-36de6f83a90b
S0635 BoomBox — malware.
BoomBox can enumerate the hostname, domain, and IP of a compromised host.[MSTIC Nobelium Toolset May 2021]
Exact relationship: relationship--773efcb6-760f-496f-92e9-2387d04d2c53
S0641 Kobalos — malware.
Kobalos can record the hostname and kernel version of the target machine.[ESET Kobalos Jan 2021]
Exact relationship: relationship--f068a0fc-0461-4034-a0ea-b629788bc9f3
S0642 BADFLICK — malware.
BADFLICK has captured victim computer name, memory space, and CPU details.[Accenture MUDCARP March 2019]
Exact relationship: relationship--634d3199-9979-4df1-8fbe-5fc355726602
S0644 ObliqueRAT — malware.
ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.[Talos Oblique RAT March 2021]
Exact relationship: relationship--792376f7-db54-4ae9-b50a-38b67ed96053
S0646 SpicyOmelette — malware.
SpicyOmelette can identify the system name of a compromised host.[Secureworks GOLD KINGSWOOD September 2018]
Exact relationship: relationship--44272fb3-a31d-4cea-b11c-b65e2bdcbd68
S0647 Turian — malware.
Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.[ESET BackdoorDiplomacy Jun 2021]
Exact relationship: relationship--da0a0a14-0f29-43f8-abf7-b281a1071928
S0649 SMOKEDHAM — malware.
SMOKEDHAM has used the <code>systeminfo</code> command on a compromised host.[FireEye SMOKEDHAM June 2021]
Exact relationship: relationship--4ae0fc35-a321-4ffb-b7fa-b03a20230fc4
S0650 QakBot — malware.
QakBot can collect system information including the OS version and domain on a compromised host.[Crowdstrike Qakbot October 2020][ATT QakBot April 2021][Group IB Ransomware September 2020][Microsoft Ransomware as a Service]
Exact relationship: relationship--d5be9ea1-7bf2-453b-bbca-19a9d82ea532
S0652 MarkiRAT — malware.
MarkiRAT can obtain the computer name from a compromised host.[Kaspersky Ferocious Kitten Jun 2021]
Exact relationship: relationship--7ac890f4-b4d0-4899-be19-bcbda48c3736
S0657 BLUELIGHT — malware.
BLUELIGHT has collected the computer name and OS version from victim machines.[Volexity InkySquid BLUELIGHT August 2021]
Exact relationship: relationship--1da27474-f902-419e-97a9-1fba8743cce8
S0658 XCSSET — malware.
XCSSET identifies the macOS version and uses <code>ioreg</code> to determine serial number.[trendmicro xcsset xcode project 2020]
Exact relationship: relationship--cb37da3b-6ffd-4882-9680-4e467f25d7f4
S0659 Diavol — malware.
Diavol can collect the computer name and OS version from the system.[Fortinet Diavol July 2021]
Exact relationship: relationship--ccd4c695-2458-4eb0-ad9c-a19d411f7627
S0660 Clambling — malware.
Clambling can discover the hostname, computer name, and Windows version of a targeted machine.[Trend Micro DRBControl February 2020][Talent-Jump Clambling February 2020]
Exact relationship: relationship--8b4c7113-2f11-44a7-863d-1ff49ae64215
S0662 RCSession — malware.
RCSession can gather system information from a compromised host.[Profero APT27 December 2020]
Exact relationship: relationship--d7e5009a-1eb3-4b74-ad0c-53ba0e151935
S0663 SysUpdate — malware.
SysUpdate can collect a system's architecture, operating system version, and hostname.[Trend Micro Iron Tiger April 2021][Lunghi Iron Tiger Linux]
Exact relationship: relationship--89d37095-2f31-42e9-b8f7-3abdd76d5f57
S0665 ThreatNeedle — malware.
ThreatNeedle can collect system profile information from a compromised host.[Kaspersky ThreatNeedle Feb 2021]
Exact relationship: relationship--53d7fdab-05fb-4427-b0e0-11463e05b3f3
S0666 Gelsemium — malware.
Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.[ESET Gelsemium June 2021]
Exact relationship: relationship--86b8a22d-66c3-4b54-82fd-662455d0e2c5
S0667 Chrommme — malware.
Chrommme has the ability to obtain the computer name of a compromised host.[ESET Gelsemium June 2021]
Exact relationship: relationship--52f3a62b-621b-4cef-86f6-8152fa719473
S0669 KOCTOPUS — malware.
KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.[MalwareBytes LazyScripter Feb 2021]
Exact relationship: relationship--55f54b3e-7058-4299-98e8-ab33dd42a6ef
S0670 WarzoneRAT — malware.
WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.[Check Point Warzone Feb 2020]
Exact relationship: relationship--384b6787-f69b-4d81-bc5e-c01a5c5b026e
S0673 DarkWatchman — malware.
DarkWatchman can collect the OS version, system architecture, and computer name.[Prevailion DarkWatchman 2021]
Exact relationship: relationship--ecb55914-837c-4600-a0f8-65d83d2d726b
S0674 CharmPower — malware.
CharmPower can enumerate the OS version and computer name on a targeted system.[Check Point APT35 CharmPower January 2022]
Exact relationship: relationship--0586324a-680a-46a4-917b-8c00c7211065
S0679 Ferocious — malware.
Ferocious can use <code>GET.WORKSPACE</code> in Microsoft Excel to determine the OS version of the compromised host.[Kaspersky WIRTE November 2021]
Exact relationship: relationship--c6172742-12ae-4d3f-9fd6-194cfdc93de7
S0680 LitePower — malware.
LitePower has the ability to enumerate the OS architecture.[Kaspersky WIRTE November 2021]
Exact relationship: relationship--f93060a3-7c58-444f-a45e-1386c289cee6
S0681 Lizar — malware.
Lizar can collect the computer name from the machine.[BiZone Lizar May 2021][SekoiaBourhis_DiceLoader_Feb2024]
Exact relationship: relationship--aaa42f0a-5709-45e2-81d3-0687b3c72cc9
S0687 Cyclops Blink — malware.
Cyclops Blink has the ability to query device information.[NCSC Cyclops Blink February 2022]
Exact relationship: relationship--350776c3-9234-4c8f-adff-9b36778e90c4
S0688 Meteor — malware.
Meteor has the ability to discover the hostname of a compromised host.[Check Point Meteor Aug 2021]
Exact relationship: relationship--c3893875-4f9e-43e4-babf-6f45ec485444
S0690 Green Lambert — malware.
Green Lambert can use `uname` to identify the operating system name, version, and processor type.[Objective See Green Lambert for OSX Oct 2021][Glitch-Cat Green Lambert ATTCK Oct 2021]
Exact relationship: relationship--48ee2b91-2ce7-46c0-a27a-aea1695355b4
S0691 Neoichor — malware.
Neoichor can collect the OS version and computer name from a compromised host.[Microsoft NICKEL December 2021]
Exact relationship: relationship--c089604b-f25e-4a4c-857b-0c2d157d34bb
S0692 SILENTTRINITY — tool.
SILENTTRINITY can collect information related to a compromised host, including OS version.[GitHub SILENTTRINITY Modules July 2019]
Exact relationship: relationship--fbe4387a-5e79-45e0-aae1-9b3a53dcd3ee
S0693 CaddyWiper — malware.
CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.[Cisco CaddyWiper March 2022][Malwarebytes IssacWiper CaddyWiper March 2022 ]
Exact relationship: relationship--6b7ef377-d7c3-47ca-9707-03d4ccaf5adb
S0697 HermeticWiper — malware.
HermeticWiper can determine the OS version and bitness on a targeted host.[SentinelOne Hermetic Wiper February 2022][Crowdstrike DriveSlayer February 2022][ESET Hermetic Wizard March 2022][Qualys Hermetic Wiper March 2022]
Exact relationship: relationship--87a01c6d-b7a3-481f-82a9-5dee8c6f91db
S1013 ZxxZ — malware.
ZxxZ has collected the host name and operating system product name from a compromised machine.[Cisco Talos Bitter Bangladesh May 2022]
Exact relationship: relationship--16e1777b-af28-412b-bcc3-469aba0f8a87
S1015 Milan — malware.
Milan can enumerate the targeted machine's name and GUID.[ClearSky Siamesekitten August 2021][Accenture Lyceum Targets November 2021]
Exact relationship: relationship--1daf23d1-fdf0-4858-8509-836efb883f18
S1016 MacMa — malware.
MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, and macOS version.[ESET DazzleSpy Jan 2022]
Exact relationship: relationship--1501c966-8f40-4093-b0d1-b3d572b3a1ee
S1018 Saint Bot — malware.
Saint Bot can identify the OS version, CPU, and other details from a victim's machine.[Malwarebytes Saint Bot April 2021]
Exact relationship: relationship--4eb0635f-1851-4516-a584-4d5ff3c2e078
S1019 Shark — malware.
Shark can collect the GUID of a targeted machine.[ClearSky Siamesekitten August 2021][Accenture Lyceum Targets November 2021]
Exact relationship: relationship--21f5a441-fe32-430e-935c-0929f4101b6e
S1020 Kevin — malware.
Kevin can enumerate the OS version and hostname of a targeted machine.[Kaspersky Lyceum October 2021]
Exact relationship: relationship--2b9ce635-3ce2-4145-864e-70b0b09438b8
S1022 IceApple — malware.
The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.[CrowdStrike IceApple May 2022]
Exact relationship: relationship--ca765e99-996e-4d0f-ada0-5c44d3930404
S1025 Amadey — malware.
Amadey has collected the computer name and OS version from a compromised machine.[Korean FSI TA505 2020][BlackBerry Amadey 2020]
Exact relationship: relationship--a6904fd0-d121-4b26-b05c-1615e3baf599
S1026 Mongall — malware.
Mongall can retrieve the hostname via `gethostbyname`.[SentinelOne Aoqin Dragon June 2022]
Exact relationship: relationship--d336d669-ef00-476d-81f6-0fe88093e1e6
S1028 Action RAT — malware.
Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.[MalwareBytes SideCopy Dec 2021]
Exact relationship: relationship--c707d09b-1b36-4a1c-99be-c905fdd3ff6b
S1029 AuTo Stealer — malware.
AuTo Stealer has the ability to collect the hostname and OS information from an infected host.[MalwareBytes SideCopy Dec 2021]
Exact relationship: relationship--96ef9f6c-46aa-4a59-ad5a-5ef72279d12a
S1030 Squirrelwaffle — malware.
Squirrelwaffle has gathered victim computer information and configurations.[ZScaler Squirrelwaffle Sep 2021]
Exact relationship: relationship--0f688474-53c2-4ad5-8998-bd8c39a79f04
S1031 PingPull — malware.
PingPull can retrieve the hostname of a compromised host.[Unit 42 PingPull Jun 2022]
Exact relationship: relationship--4e109125-e22b-4aaf-ac3c-9a0f5351b440
S1034 StrifeWater — malware.
StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host.[Cybereason StrifeWater Feb 2022]
Exact relationship: relationship--9ba5068b-4e9e-445f-831b-c3d8ca444e2a
S1037 STARWHALE — malware.
STARWHALE can gather the computer name of an infected host.[Mandiant UNC3313 Feb 2022][DHS CISA AA22-055A MuddyWater February 2022]
Exact relationship: relationship--12168524-c6cf-4b8f-b114-7b10b06b8f32
S1039 Bumblebee — malware.
Bumblebee can enumerate the OS version and domain on a targeted system.[Google EXOTIC LILY March 2022][Proofpoint Bumblebee April 2022][Symantec Bumblebee June 2022]
Exact relationship: relationship--02a1f8ce-390e-46e4-b945-9cd61c593f9f
S1048 macOS.OSAMiner — malware.
macOS.OSAMiner can gather the device serial number.[SentinelLabs reversing run-only applescripts 2021]
Exact relationship: relationship--71935bd0-44ca-4d2b-850d-707bc4db91d5
S1052 DEADEYE — malware.
DEADEYE can enumerate a victim computer's volume serial number and host name.[Mandiant APT41]
Exact relationship: relationship--2eb32b46-9833-4391-b282-c7ee10bbfc62
S1059 metaMain — malware.
metaMain can collect the computer name from a compromised host.[SentinelLabs Metador Technical Appendix Sept 2022]
Exact relationship: relationship--fcad9dc8-fa79-491e-91ec-35a2a9cd55e8
S1060 Mafalda — malware.
Mafalda can collect the computer name of a compromised host.[SentinelLabs Metador Sept 2022][SentinelLabs Metador Technical Appendix Sept 2022]
Exact relationship: relationship--91cea20a-9698-4bec-8fdd-c1eda3ea66e7
S1064 SVCReady — malware.
SVCReady has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use of `systeminfo.exe`.[HP SVCReady Jun 2022]
Exact relationship: relationship--bfaa2e3f-fab0-4136-a951-ed1bad30a771
S1065 Woody RAT — malware.
Woody RAT can retrieve the following information from an infected machine: OS, architecture, computer name, OS build version, and environment variables.[MalwareBytes WoodyRAT Aug 2022]
Exact relationship: relationship--303ff42e-09fa-49ab-9fa3-420aedb090dc
S1066 DarkTortilla — malware.
DarkTortilla can obtain system information by querying the `Win32_ComputerSystem`, `Win32_BIOS`, `Win32_MotherboardDevice`, `Win32_PnPEntity`, and `Win32_DiskDrive` WMI objects.[Secureworks DarkTortilla Aug 2022]
Exact relationship: relationship--48a5b14e-81c8-4629-a846-7c8273bc3963
S1068 BlackCat — malware.
BlackCat can obtain the computer name and UUID.[Microsoft BlackCat Jun 2022]
Exact relationship: relationship--3ca38ed9-3691-461d-81a1-1ad8de5817bb
S1070 Black Basta — malware.
Black Basta can collect system boot configuration and CPU information.[Minerva Labs Black Basta May 2022][Cyble Black Basta May 2022]
Exact relationship: relationship--0e714323-a3b6-4848-852c-5e35608d0970
S1073 Royal — malware.
Royal can use `GetNativeSystemInfo` to enumerate system processors.[Cybereason Royal December 2022][Trend Micro Royal Linux ESXi February 2023]
Exact relationship: relationship--20f43b8b-55c7-4710-8813-6512c3b11c1a
S1078 RotaJakiro — malware.
RotaJakiro executes a set of commands to collect device information, including `uname`. Another example is the `cat /etc/*release | uniq` command used to collect the current OS distribution.[RotaJakiro 2021 netlab360 analysis]
Exact relationship: relationship--87ef3b62-acb4-4cd2-86ec-36683a57bedf
S1081 BADHATCH — malware.
BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, OS type/version, bitness, and hostname.[Gigamon BADHATCH Jul 2019][BitDefender BADHATCH Mar 2021]
Exact relationship: relationship--2c88062e-f63f-4313-85ef-3d68a9d3fde5
S1085 Sardonic — malware.
Sardonic has the ability to collect the computer name, and CPU manufacturer name from a compromised machine. Sardonic also has the ability to execute the `ver` and `systeminfo` commands.[Bitdefender Sardonic Aug 2021]
Exact relationship: relationship--12ecc5cc-dad6-4532-9945-df575b008c2a
S1086 Snip3 — malware.
Snip3 has the ability to query `Win32_ComputerSystem` for system information. [Morphisec Snip3 May 2021]
Exact relationship: relationship--6deb7ae9-9e35-47cb-8db2-e708ad9543b6
S1100 Ninja — malware.
Ninja can obtain the computer name and information on the OS from targeted hosts.[Kaspersky ToddyCat June 2022][Kaspersky ToddyCat Check Logs October 2023]
Exact relationship: relationship--708161ff-7d5d-417a-83ad-d68ec6d4d01a
S1107 NKAbuse — malware.
NKAbuse conducts multiple system checks and includes these in subsequent "heartbeat" messages to the malware's command and control server.[NKAbuse SL]
Exact relationship: relationship--6eb8329a-b0ca-4751-a014-473af182b177
S1111 DarkGate — malware.
DarkGate will gather various system information such as domain, display adapter description, operating system type and version, processor type, and RAM amount.[Ensilo Darkgate 2018][Rapid7 BlackBasta 2024]
Exact relationship: relationship--011286cc-53bc-4910-bf38-79f1d79fc707
S1121 LITTLELAMB.WOOLTEA — malware.
LITTLELAMB.WOOLTEA can check the type of Ivanti VPN device it is running on by executing `first_run()` to identify the first four bytes of the motherboard serial number.[Mandiant Cutting Edge Part 3 February 2024]
Exact relationship: relationship--f619f10a-a579-49a6-a64f-80be117eea94
S1122 Mispadu — malware.
Mispadu collects the OS version, computer name, and language ID.[ESET Security Mispadu Facebook Ads 2019]
Exact relationship: relationship--4d39c319-bf5d-4129-83ba-11df82fdca17
S1124 SocGholish — malware.
SocGholish has the ability to enumerate system information including the victim computer name.[SocGholish-update][Red Canary SocGholish March 2024][Secureworks Gold Prelude Profile]
Exact relationship: relationship--1a28d78a-d11b-466a-977f-19d2e88c1952
S1129 Akira — malware.
Akira uses the <code>GetSystemInfo</code> Windows function to determine the number of processors on a victim machine.[Kersten Akira 2023]
Exact relationship: relationship--0d853746-8d17-4d1a-be4a-6133e39a6c84
S1130 Raspberry Robin — malware.
Raspberry Robin performs several system checks as part of anti-analysis mechanisms, including querying the operating system build number, processor vendor and type, video controller, and CPU temperature.[HP RaspberryRobin 2024]
Exact relationship: relationship--11764f59-a7b9-4dff-8e37-471d739f5343
S1138 Gootloader — malware.
Gootloader can inspect the User-Agent string in GET request header information to determine the operating system of targeted systems.[Sophos Gootloader]
Exact relationship: relationship--7f4685df-335f-4c8a-900a-4018e52d92c3
S1141 LunarWeb — malware.
LunarWeb can use WMI queries and shell commands such as systeminfo.exe to collect the operating system, BIOS version, and domain name of the targeted system.[ESET Turla Lunar toolset May 2024]
Exact relationship: relationship--0ed59ea2-85bb-4633-9b55-9e322dcbbd83
S1142 LunarMail — malware.
LunarMail can capture environmental variables on compromised hosts.[ESET Turla Lunar toolset May 2024]
Exact relationship: relationship--b7d456ea-d533-4d29-b6d4-45586c4a124e
S1145 Pikabot — malware.
Pikabot performs a variety of system checks and gathers system information, including commands such as <code>whoami</code>.[Zscaler Pikabot 2023][Elastic Pikabot 2024]
Exact relationship: relationship--713bde00-ab9d-4eaf-99b2-4d9b2b21df4c
S1147 Nightdoor — malware.
Nightdoor gathers information on the victim system such as CPU and Computer name as well as device drivers.[ESET EvasivePanda 2024]
Exact relationship: relationship--e0dc0d73-4e0a-46a6-8100-0c231eba58a5
S1148 Raccoon Stealer — malware.
Raccoon Stealer gathers information on infected systems such as operating system, processor information, RAM, and display information.[S2W Racoon 2022][Sekoia Raccoon2 2022]
Exact relationship: relationship--e5b20ee8-7af4-41a4-ac76-622a55a37e13
S1152 IMAPLoader — malware.
IMAPLoader uses WMI queries to gather information about the victim machine.[PWC Yellow Liderc 2023]
Exact relationship: relationship--778df1e8-d307-496d-861a-45052ee2e019
S1153 Cuckoo Stealer — malware.
Cuckoo Stealer can gather information about the OS version and hardware on compromised hosts.[Kandji Cuckoo April 2024][SentinelOne Cuckoo Stealer May 2024]
Exact relationship: relationship--eeb8635c-0297-470c-a66c-56f8e30c771e
S1155 Covenant — tool.
Covenant implants can gather basic information on infected systems.[Github Covenant]
Exact relationship: relationship--698c4736-5a86-4d72-9855-4bdee856d6de
S1156 Manjusaka — malware.
Manjusaka performs basic system profiling actions to fingerprint and register the victim system with the C2 controller.[Talos Manjusaka 2022]
Exact relationship: relationship--0fa5e3ed-8b00-4f03-9adf-caf5d0e0bd2c
S1159 DUSTTRAP — malware.
DUSTTRAP reads the value of the infected system's `HKLM\SYSTEM\Microsoft\Cryptography\MachineGUID` value.[Google Cloud APT41 2024]
Exact relationship: relationship--d96e80d3-f4ca-40bd-ae69-979a0a782a57
S1160 Latrodectus — malware.
Latrodectus can gather operating system information.[Latrodectus APR 2024][Elastic Latrodectus May 2024][Elastic Latrodectus May 2024][Bitsight Latrodectus June 2024]
Exact relationship: relationship--ac4b5156-e98e-4826-abc5-02e244496c03
S1166 Solar — malware.
Solar can send basic information about the infected host to C2.[ESET OilRig Campaigns Sep 2023]
Exact relationship: relationship--8ed87a9f-db10-4e2c-aa3d-cf1e92797d1f
S1167 AcidPour — malware.
AcidPour can identify various system locations and mapped devices on Linux systems as a precursor to wiping activity.[SentinelOne AcidPour 2024]
Exact relationship: relationship--85c11944-e1a0-49e0-a0ef-03e9df1b2adb
S1168 SampleCheck5000 — malware.
SampleCheck5000 can create unique victim identifiers by using the compromised system’s computer name.[ESET OilRig Downloaders DEC 2023]
Exact relationship: relationship--a0e78137-f13e-491e-ba5e-d1cd005ab17c
S1169 Mango — malware.
Mango can collect the machine name of a compromised system which is later used as part of a unique victim identifier.[ESET OilRig Campaigns Sep 2023]
Exact relationship: relationship--4a1308c8-a392-4d89-8fb2-90692e07cadb
S1172 OilBooster — malware.
OilBooster can identify the compromised system's hostname which is used to create a unique identifier.[ESET OilRig Downloaders DEC 2023]
Exact relationship: relationship--2c351c25-fc11-4168-9ad5-6a5aab84634c
S1178 ShrinkLocker — malware.
ShrinkLocker uses WMI queries to gather various information about the victim machine and operating system.[Kaspersky ShrinkLocker 2024][Splunk ShrinkLocker 2024]
Exact relationship: relationship--1b265c93-7331-41b7-9cf2-c8c21a0969e7
S1180 BlackByte Ransomware — malware.
BlackByte Ransomware gathers victim system information to generate a unique victim identifier.[Trustwave BlackByte 2021]
Exact relationship: relationship--804cf89b-1070-44e1-a479-a07558ae3128
S1182 MagicRAT — malware.
MagicRAT collects basic system information from victim machines.[Cisco MagicRAT 2022]
Exact relationship: relationship--bb4e12ab-cfaa-4693-9156-bb97fc9c5b92
S1183 StrelaStealer — malware.
StrelaStealer variants collect victim system information for exfiltration.[IBM StrelaStealer 2024]
Exact relationship: relationship--de9ac4ba-9e06-4704-9549-b3c59882bdb2
S1184 BOLDMOVE — malware.
BOLDMOVE performs system survey actions following initial execution.[Google Cloud BOLDMOVE 2023]
Exact relationship: relationship--c4684b0f-86e1-4200-bd12-e9472f892779
S1185 LightSpy — malware.
LightSpy's second stage implant uses the `DeviceInformation` class to collect system information, including CPU usage, battery statistics, memory allocations, screen size, etc.[Huntress LightSpy macOS 2024]
Exact relationship: relationship--6d965ba4-b5f3-40ce-9153-b328e4b54429
S1186 Line Dancer — malware.
Line Dancer can gather system configuration information by running the native `show configuration` command.[Cisco ArcaneDoor 2024]
Exact relationship: relationship--e452a193-b1a0-40b6-af3e-a734859fcf0b
S1190 Kapeka — malware.
Kapeka utilizes WinAPI calls and registry queries to gather system information.[WithSecure Kapeka 2024]
Exact relationship: relationship--2cc929d2-469a-4c71-ba4e-bc3dec29da5c
S1196 Troll Stealer — malware.
Troll Stealer can collect local system information.[S2W Troll Stealer 2024][Symantec Troll Stealer 2024]
Exact relationship: relationship--a6f98712-2c65-493f-a707-db17417e5c80
S1198 Gomir — malware.
Gomir collects information on infected systems such as hostname, username, CPU, and RAM information.[Symantec Troll Stealer 2024]
Exact relationship: relationship--d31367da-4a66-4fe2-ac2c-d54ba1e985b0
S1199 LockBit 2.0 — malware.
LockBit 2.0 can enumerate system information including hostname and domain information.[FBI Lockbit 2.0 FEB 2022][Palo Alto Lockbit 2.0 JUN 2022]
Exact relationship: relationship--65f3f758-ac69-4f7a-b56e-6bbafddae619
S1200 StealBit — malware.
StealBit can enumerate the computer name and domain membership of the compromised system.[Cybereason StealBit Exfiltration Tool]
Exact relationship: relationship--97a31149-5322-472a-b443-b60ab1cec1af
S1202 LockBit 3.0 — malware.
LockBit 3.0 can enumerate system hostname and domain.[Joint Cybersecurity Advisory LockBit 3.0 MAR 2023]
Exact relationship: relationship--9273ab6e-ccee-40ed-8cf1-420cd0650d20
S1207 XLoader — malware.
XLoader can collect system information and supported language information from the victim machine.[Acronis XLoader 2021]
Exact relationship: relationship--cc8a3a34-1324-4a4d-8557-3c23fad2b07c
S1210 Sagerunex — malware.
Sagerunex gathers information from the infected system such as hostname.[Cisco LotusBlossom 2025]
Exact relationship: relationship--7e618069-63cd-4739-bbaf-8582743906f8
S1212 RansomHub — malware.
RansomHub can retrieve information about virtual machines.[Group-IB RansomHub FEB 2025]
Exact relationship: relationship--f6208ff3-bf0a-4461-bb60-bc6c58cb9e49
S1213 Lumma Stealer — malware.
Lumma Stealer has gathered various system information from victim machines.[Cybereason LumaStealer Undated][Fortinet LummaStealer 2024][TrendMicro LummaStealer 2025]
Exact relationship: relationship--fe865909-091d-42cd-82a1-5cfc5df38e4d
S1222 RIFLESPINE — malware.
RIFLESPINE can collect system information after installation on infected systems.[Google Cloud Mandiant UNC3886 2024]
Exact relationship: relationship--80c87037-4997-449c-8a92-1183103dda8d
S1228 PUBLOAD — malware.
PUBLOAD has collected and sent system information including volume serial number, computer name, and system uptime to designated C2.[Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022][2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA] PUBLOAD has also used several commands executed in sequence via `cmd` in a short interval to gather system information about the infected host including `systeminfo`.[Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024] PUBLOAD has decrypted shellcode that collects the computer name.[2022 November_TrendMicro_Earth Preta_Toneshell_Pubload]
Exact relationship: relationship--ff57d2d8-095c-4f9b-bb57-bc0971bb6a8d
S1229 Havoc — malware.
Havoc can gather system information including hostname, domain, and OS details.[Fortinet Havoc MAR 2025]
Exact relationship: relationship--4e52b5b5-5f7d-4900-aae0-34b2d71b90e0
S1234 SplatCloak — malware.
SplatCloak has collected the Windows build number using the windows kernel API `RtlGetVersion` to determine if the response is 19000 or higher (Windows 10 version 2004 or later).[Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025]
Exact relationship: relationship--08b94d01-f4c1-4692-aa39-a203fd97d581
S1239 TONESHELL — malware.
TONESHELL has the ability to retrieve the name of the infected machine.[2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA][Trend Micro Mustang Panda Earth Preta Toneshell February 2025][Zscaler]
Exact relationship: relationship--2f2a1144-7a4c-4a9e-9446-627ab73e08da
S1240 RedLine Stealer — malware.
RedLine Stealer can collect information about the local system.[Kroll RedLine Stealer August 2024][Proofpoint RedLine Stealer March 2020][Splunk RedLine Stealer June 2023][Veriti RedLine Stealer MAAS April 2023]
Exact relationship: relationship--afe95822-7845-4f16-b50c-62f428c59697
S1242 Qilin — malware.
Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.[Trend Micro Agenda Ransomware OCT 2025]
Exact relationship: relationship--014d0996-93ef-4435-aac2-f73dbd4a9d60
S1244 Medusa Ransomware — malware.
Medusa Ransomware has collected data from the SMBIOS firmware table using `GetSystemFirmwareTable`.[Security Scorecard Medusa Ransomware January 2024]
Exact relationship: relationship--c6f6b904-0246-471c-93ca-0b70c70b0c96
S1245 InvisibleFerret — malware.
InvisibleFerret has collected OS type, hostname and system version through the "pay" module.[Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024][ESET Contagious Interview BeaverTail InvisibleFerret February 2025] InvisibleFerret has also queried the victim device using Python scripts to obtain the User and Hostname.[Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025][PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023]
Exact relationship: relationship--01a2dceb-e7bf-414b-9919-6c9724cfb404
S1246 BeaverTail — malware.
BeaverTail has been known to collect basic system information.[Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024][PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023] BeaverTail has also collected data to include hostname and current timestamp prior to uploading data to the API endpoint `/uploads` on the C2 server.[ESET Contagious Interview BeaverTail InvisibleFerret February 2025]
Exact relationship: relationship--4c5755ef-d3fc-457d-9103-8bb9e37ae462
S1248 XORIndex Loader — malware.
XORIndex Loader has the ability to collect the hostname, OS Username, Geolocation, and OS version of an infected host.[Socket BeaverTail XORIndex HexEval Contagious Interview July 2025]
Exact relationship: relationship--196fcf2a-e520-4fab-baa2-68af3cb0e57c
S1249 HexEval Loader — malware.
HexEval Loader has identified the OS and MAC address of victim device through host fingerprinting scripting.[Socket HexEval BeaverTail Contagious Interview June 2025]
Exact relationship: relationship--01933b06-956c-4f09-9dcc-e7c6b672dc94
S9001 SystemBC — malware.
SystemBC has collected username , build number and serial number, then sent the information to the C2 server.[SophosGnGal_SystemBC_Dec2020][AhnLab_SystemBC_Apr2022] SystemBC has also gathered device name, operating system, and processor type.[HarmonProofpoint_SystemBC_Aug2019]
Exact relationship: relationship--670b59d4-25c6-4171-a36b-efb27155cc95
S9002 Diskpart — tool.
Diskpart can show information about the selected disk, partition, volume, or virtual hard disk (VHD).[Microsoft_diskpart_Feb2023]
Exact relationship: relationship--5619736a-4081-4fc3-93b7-cf70d01cd094
S9008 Shai-Hulud — malware.
Shai-Hulud has gathered victim system information.[Aikido Shai-Hulud September 2025][Socket Shai-Hulud November 2025]
Exact relationship: relationship--d7643073-825d-407c-b2ba-11c313ea6a9e
S9010 GlassWorm — malware.
GlassWorm has the ability to check the OS of the victim host.[Socket GlassWorm January 2026][Koi GlassWorm Rust December 2025] GlassWorm has checked whether the OS platform value includes `darwin` prior to execution of macOS specific scripts.[Socket GlassWorm January 2026][Koi GlassWorm Rust December 2025]
Exact relationship: relationship--b5076cf3-ccd5-4dd7-895b-abf79eddf63f
S9019 PureCrypter — malware.
PureCrypter can enumerate a targeted system's SerialNumber and Version.[Zscaler PureCrypter JUN 2022][Check Point Blind Eagle MAR 2025]
Exact relationship: relationship--0e770d53-2dea-4d8d-8bbf-a2290d4a78a7
S9020 LODEINFO — malware.
LODEINFO can disover machine information including OS architecture, the ANSI code page (ACP) identifier, and hostname.[Kaspersky LODEINFO Part II OCT 2022][ITOCHU LODEINFO JAN 2024]
Exact relationship: relationship--83b6ef41-24e7-4ace-bb6e-29faf8ac5ab4
S9023 HiddenFace — malware.
HiddenFace can enumerate the hostname and username of the compromised system.[ESET HiddenFace 2024][Trend Micro Earth Kasha NOV 2024][JPCERT MirrorFace JUL 2024]
Exact relationship: relationship--8aec9b0d-392b-438f-9953-82406e940a44
S9024 SPAWNCHIMERA — malware.
SPAWNCHIMERA has obtained system information such as release, uptime, and current time.[Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024]
Exact relationship: relationship--fbcc97eb-3768-4c8f-b00e-eb84a69fc0da
S9025 NOOPLDR — malware.
NOOPLDR can discover the device ID and hostname from the targeted machine to use for encryption keys.[Trend Micro Earth Kasha NOV 2024]
Exact relationship: relationship--e07c827b-aa0a-4cc5-b1ff-a2905bc99027
S9029 IronWind — malware.
IronWind can capture the OS version and computer name of the compromised host.[Check Point Wirte NOV 2024]
Exact relationship: relationship--2dfd1cd3-c2da-4c65-9699-54b943b8c08d
S9031 AshTag — malware.
The AshTag loader and AshenOrchestrator components can collect reconnaissance data from victim machines.[Palo Alto Ashen Lepus DEC 2025]
Exact relationship: relationship--24edc813-1a52-47ae-9068-7423c0052a43
S9034 Tsundere Botnet — malware.
Tsundere Botnet has collected the machine’s MAC address, total memory, GPU information and other system information.[SecureListUbiedo_Tsundere_Nov2025]
Exact relationship: relationship--c97ef137-79d7-4e87-ba15-f719724eb15b
S9035 LAMEHUG — malware.
LAMEHUG has the ability to execute Windows commands returned from C2 to gather system information.[Splunk LAMEHUG SEP 2025][Nov AI Threat Tracker]
Exact relationship: relationship--170e1e46-f3ea-4edb-a115-dde5a7c13e0f
S9037 RustyWater — malware.
RustyWater has gathered the victim machine’s computer name.[CloudSEK_RustyWater_Jan2026]   
Exact relationship: relationship--2854c1cb-d7e6-484a-afff-4a1e3a43df64
S9039 LazyWiper — malware.
LazyWiper has used `[System.Net.Dns]::GetHostName()` and `$env:COMPUTERNAME` to enumerate the hostname of a system and determine if it is a domain controller.[CERT Polska]
Exact relationship: relationship--6ddcaca1-4fd9-4a9f-a4fe-2e5824958f8d
S9041 TeamPCP Cloud Stealer — malware.
TeamPCP Cloud Stealer has detected if it is on a developer machine by checking if the environmental variable  GITHUB_ACTIONS != “true”.[Wiz Trivy Compromise MAR 2026] TeamPCP Cloud Stealer has also identified readable memory regions on CI/CD runners and enumerated system information using `hostname` and `uname-a`.[Aqua Security Blog Trivy Compromise APR 2026]
Exact relationship: relationship--f99c66b5-df6f-4097-b72b-82bbe3f5fe02
S9043 Mini Shai-Hulud — malware.
Mini Shai-Hulud has gathered system information of victim hosts through the use of common discovery commands to include `hostname`, `uname-a` and `printenv`.[Trend Micro TeamPCP MAY 2026] Mini Shai-Hulud has also conducted system checks of the victim device to include enumerating the system type and the number of CPUs operating on victim host.[Hunt.io TeamPCP Toolkit MAY 2026][Phoenix TeamPCP 20 MAY 2026]
Exact relationship: relationship--aa4acffb-0b5c-48b3-b0c4-d321e6ae842d
S9045 BACKUPOSINT v9.0 APEX PREDATOR — malware.
BACKUPOSINT v9.0 APEX PREDATOR has discovered system configurations on victim devices.[AI-Mexico-Govt-Breach]
Exact relationship: relationship--12a69be7-09b4-4188-9b78-a035d0b622ee
S9046 IOControl — malware.
IOCONTROL has used the `uname -v` and `uname –r` commands to obtain kernel version and release information as well as the `hostname` command to obtain the hostname of the system.[Claroty-IOCONTROL][Armis-IOCONTROL]
Exact relationship: relationship--8e44e98f-b8aa-46f2-83dd-ada429e9f4e9
S9050 Vidar — malware.
Vidar has gathered hardware IDs (HWIDs) regarding the victim machine.[Unit42_Vidar_July2026] Vidar has used `GetEnvironmentStringsW` and `GetModuleHandleExW` to gather information about the victim machine.[Cyfirma_Vidar_June2024] Vidar has collected OS data from the victim machine.[QuorumCyber_Vidar_March2023][Logpoint_StealerMalwareFamilies_2024]
Exact relationship: relationship--b880fc5d-236d-44b5-90ec-46ce43c330ed
S9052 MiniFast — malware.
MiniFast has collected the victim's username, hostname and domain information.[CheckPoint_NimbusManticore_May2026]
Exact relationship: relationship--c40c369b-d68a-4f89-a5ee-4fa5b95bf472
S9053 MiniJunk — malware.
MiniJunk has the ability to gather the computer name.[CheckPoint_NimbusManticoreEurope_Sept2025]
Exact relationship: relationship--fbf97550-8c44-4b68-8c99-8a61dfae4947
S9059 MiniBike — malware.
MiniBike has collected system information from the victim machine.[Mandiant_UNC1549_Feb2024]
Exact relationship: relationship--dea3c118-57a6-4ce2-b8f2-01cb6e417d6d
S9063 DEEPROOT — malware.
DEEPROOT has gathered the victim hostname.[Mandiant_UNC1549_Nov2025]
Exact relationship: relationship--8cc363e3-8239-4eb9-b149-cdacedd2879c
S9067 TWOSTROKE — malware.
TWOSTROKE has gathered victim hostname and the domain through `GetComputerNameExW(ComputerNameDnsFullyQualified)`.[Mandiant_UNC1549_Nov2025]
Exact relationship: relationship--09a27a67-29f5-4ecf-ac38-b0acd0041105

Simulation design and documented procedures

Atomic evidence: 40 compatible documented candidates. Live lab status: not run for these imported procedures.

Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.

Linux List Kernel Modules

Enumerate kernel modules installed 3 different ways. Upon successful execution stdout will display kernel modules installed on host 2 times, followed by list of modules matching 'vmw' if present.

Pinned Atomic procedure · 034fe21c-3186-49dd-8d5d-128b35f181c7 · linux · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

WinPwn - PowerSharpPack - Watson searching for missing windows patches

PowerSharpPack - Watson searching for missing windows patches technique via function of WinPwn

Pinned Atomic procedure · 07b18a66-6304-47d2-bad0-ef421eb2e107 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

ESXi - VM Discovery using ESXCLI

An adversary will using ESXCLI to enumerate the Virtual Machines on the host prior to executing power off routine. Reference

Pinned Atomic procedure · 2040405c-eea6-4c1c-aef3-c2acc430fac9 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

vm_host: Specify the host name or IP of the ESXi Server (type string; source default atomic.local)
vm_user: Specify the privilege user account on ESXi Server (type string; source default root)
vm_pass: Specify the privilege user password on ESXi Server (type string; source default pass)
plink_file: Path to Plink (type path; source default PathToAtomicsFolder\..\ExternalPayloads\plink.exe)
cli_script: Path to file with discovery commands (type path; source default PathToAtomicsFolder\T1082\src\esx_vmdiscovery.txt)

1 prerequisite definitions:

Check if plink is available.

Windows MachineGUID Discovery

Identify the Windows MachineGUID value for a system. Upon execution, the machine GUID will be displayed from registry.

Pinned Atomic procedure · 224b4daf-db44-404e-b6b2-f4d1f0126ef8 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Linux VM Check via Hardware

Identify virtual machine hardware. This technique is used by the Pupy RAT and other malware.

Pinned Atomic procedure · 31dad7ad-2286-4c02-ae92-274418c85fec · linux · bash.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

WinPwn - Morerecon

Gathers local system information using the Morerecon function of WinPwn

Pinned Atomic procedure · 3278b2f6-f733-4875-9ef4-bfed34244f0a · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Show System Integrity Protection status (MacOS)

Read and Display System Intergrety Protection status. csrutil is commonly used by malware and post-exploitation tools to determine whether certain files and directories on the system are writable or not.

Pinned Atomic procedure · 327cc050-9e99-4c8e-99b5-1d15f2fb6b96 · macos · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

WinPwn - Powersploits privesc checks

Powersploits privesc checks using oldchecks function of WinPwn

Pinned Atomic procedure · 345cb8e4-d2de-4011-a580-619cf5a9e2d7 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

WinPwn - itm4nprivesc

Discover Local Privilege Escalation possibilities using itm4nprivesc function of WinPwn

Pinned Atomic procedure · 3d256a2f-5e57-4003-8eb6-64d91b1da7ce · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

System Information Discovery

The script gathernetworkinfo.vbs is employed to collect system information such as the operating system, DNS details, firewall configuration, etc. Outputs are stored in c:\Windows\System32\config or c:\Windows\System32\reg. https://www.verboon.info/2011/06/the-gathernetworkinfo-vbs-script/

Pinned Atomic procedure · 4060ee98-01ae-4c8e-8aad-af8300519cc7 · windows · command_prompt.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Hostname Discovery

Identify system hostname for FreeBSD, Linux and macOS systems.

Pinned Atomic procedure · 486e88ea-4f56-470f-9b57-3f4d73f39133 · linux, macos · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

FreeBSD List Kernel Modules

Enumerate kernel modules loaded. Upon successful execution stdout will display kernel modules loaded, followed by list of modules matching 'vmm' if present.

Pinned Atomic procedure · 4947897f-643a-4b75-b3f5-bed6885749f6 · linux · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

WinPwn - General privesc checks

General privesc checks using the otherchecks function of WinPwn

Pinned Atomic procedure · 5b6f39a2-6ec7-4783-a5fd-2c54a55409ed · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

WinPwn - PowerSharpPack - Seatbelt

PowerSharpPack - Seatbelt technique via function of WinPwn.

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

Pinned Atomic procedure · 5c16ceb4-ba3a-43d7-b848-a13c1f216d95 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

System Information Discovery

Identify System Info. Upon execution, system info and time info will be displayed.

Pinned Atomic procedure · 66703791-c902-4560-8770-42b8a91f7667 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Griffon Recon

This script emulates the reconnaissance script seen in used by Griffon and was modified by security researcher Kirk Sayre in order simply print the recon results to the screen as opposed to exfiltrating them. Script. For more information see also https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon and https://attack.mitre.org/software/S0417/

Pinned Atomic procedure · 69bd4abe-8759-49a6-8d21-0f15822d6370 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

vbscript: Path to sample script (type string; source default PathToAtomicsFolder\T1082\src\griffon_recon.vbs)

1 prerequisite definitions:

Sample script file must exist on disk at specified location (#{vbscript})

operating system discovery

operating system discovery using get-ciminstance
https://petri.com/getting-operating-system-information-powershell/

Pinned Atomic procedure · 70e13ef4-5a74-47e4-9d16-760b41b0e2db · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Display volume shadow copies with "vssadmin"

The command shows all available volume shadow copies, along with their creation time and location.

Pinned Atomic procedure · 7161b085-816a-491f-bab4-d68e974b7995 · windows · command_prompt.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

WinPwn - GeneralRecon

Collect general computer informations via GeneralRecon function of WinPwn

Pinned Atomic procedure · 7804659b-fdbf-4cf6-b06a-c03e758590e8 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Linux VM Check via Kernel Modules

Identify virtual machine guest kernel modules. This technique is used by the Pupy RAT and other malware.

Pinned Atomic procedure · 8057d484-0fae-49a4-8302-4812c4f1e64e · linux · bash.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Hostname Discovery (Windows)

Identify system hostname for Windows. Upon execution, the hostname of the device will be displayed.

Pinned Atomic procedure · 85cfbf23-4a1e-4342-8792-007e004b975f · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

System Information Discovery with WMIC

Identify system information with the WMI command-line (WMIC) utility. Upon execution, various system information will be displayed, including: OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions.
https://nwgat.ninja/getting-system-information-with-wmic-on-windows/
Elements of this test were observed in the wild used by Aurora Stealer in late 2022 and early 2023, as highlighted in public reporting:
https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar
https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/

Pinned Atomic procedure · 8851b73a-3624-4bf7-8704-aa312411565c · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Check computer location

Looks up country code configured in the registry, likely geofence. Upon execution, country code info will be displayed.
- https://tria.ge/210111-eaz8mqhgh6/behavioral1

Pinned Atomic procedure · 96be6002-9200-47db-94cb-c3e27de1cb36 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Discover OS Build Number via Registry

Identify the Operating System Build Number via registry with the reg.exe command.
Upon execution, the OS Build Number will be displayed.

Pinned Atomic procedure · acfcd709-0013-4f1e-b9ee-bc1e7bafaaec · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Discover OS Product Name via Registry

Identify the Operating System Product Name via registry with the reg.exe command.
Upon execution, the OS Product Name will be displayed.

Pinned Atomic procedure · be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Enumerate Available Drives via gdr

This test simulates an attacker attempting to list the available drives on the system to gather data about file storage locations.

Pinned Atomic procedure · c187c9bc-4511-40b3-aa10-487b2c70b6a5 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

sysctl to gather macOS hardware info

Gets the macOS hardware information, which can be used to determine whether the target macOS host is running on a physical or virtual machine. sysctl can be used to gather interesting macOS host data, including hardware information, memory size, logical cpu information, etc.

Pinned Atomic procedure · c8d40da9-31bd-47da-a497-11ea55d1ef6c · macos · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

List OS Information

Identify System Info

Pinned Atomic procedure · cccb070c-df86-4216-a5bc-9fb60c74e27c · linux, macos · sh.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

output_file: Output file used to store the results. (type path; source default /tmp/T1082.txt)

Get System Hardware UUID Via wmic.exe

Upon execution, displays the system's hardware UUID. Used in BlackCat ransomware to generate a recovery URL.

Pinned Atomic procedure · cd6fc00d-ad6e-431c-832c-33e97ab9218f · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Identify System Locale and Regional Settings with PowerShell

This action demonstrates how an attacker might gather a system's region and language settings using PowerShell, which could aid in profiling
the machine's location and user language preferences. The command outputs system locale details to a temporary file for further analysis.

Pinned Atomic procedure · ce479c1a-e8fa-42b2-812a-96b0f2f4d28a · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

WinPwn - RBCD-Check

Search for Resource-Based Constrained Delegation attack paths using RBCD-Check function of WinPwn

Pinned Atomic procedure · dec6a0d8-bcaf-4c22-9d48-2aee59fb692b · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

System Information Discovery

Identify System Info

Pinned Atomic procedure · edff98ec-0f73-4f63-9890-6b117092aff6 · macos · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

WinPwn - winPEAS

Discover Local Privilege Escalation possibilities using winPEAS function of WinPwn

Pinned Atomic procedure · eea1d918-825e-47dd-acc2-814d6c58c0e1 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

FreeBSD VM Check via Kernel Modules

Identify virtual machine host kernel modules.

Pinned Atomic procedure · eefe6a49-d88b-41d8-8fc2-b46822da90d3 · linux · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors

PowerSharpPack - Sharpup checking common Privesc vectors technique via function of WinPwn - Takes several minutes to complete.

Pinned Atomic procedure · efb79454-1101-4224-a4d0-30c9c8b29ffc · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

BIOS Information Discovery through Registry

Looks up for BIOS information in the registry. BIOS information is often read in order to detect sandboxing environments. Upon execution, BIOS information will be displayed.
- https://tria.ge/210111-eaz8mqhgh6/behavioral1
- https://evasions.checkpoint.com/techniques/registry.html

Pinned Atomic procedure · f2f91612-d904-49d7-87c2-6c165d23bead · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Environment variables discovery on windows

Identify all environment variables. Upon execution, environments variables and your path info will be displayed.

Pinned Atomic procedure · f400d1c0-1804-4ff8-b069-ef5ddd2adbf3 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Check OS version via "ver" command

Ver command shows information about os version.

Pinned Atomic procedure · f6ecb109-df24-4303-8d85-1987dbae6160 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

ESXi - Darkside system information discovery

Darkside ransomware utilises various ESXCLI commands to obtain information about the ESXi Host. Reference

Pinned Atomic procedure · f89812e5-67d1-4f49-86fa-cbc6609ea86a · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

vm_host: Specify the host name or IP of the ESXi Server (type string; source default atomic.local)
vm_user: Specify the privilege user account on ESXi Server (type string; source default root)
vm_pass: Specify the privilege user password on ESXi Server (type string; source default pass)
plink_file: Path to Plink (type path; source default PathToAtomicsFolder\..\ExternalPayloads\plink.exe)
cli_script: Path to file containing darkside ransomware discovery commands (type path; source default PathToAtomicsFolder\T1082\src\esx_darkside_discovery.txt)

1 prerequisite definitions:

Check if plink is available.

Environment variables discovery on freebsd, macos and linux

Identify all environment variables. Upon execution, environments variables and your path info will be displayed.

Pinned Atomic procedure · fcbdd43f-f4ad-42d5-98f3-0218097e2720 · linux, macos · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Technique-specific experiment contract

Choose one procedure implementing T1082 System Information Discovery; identify the observable behavior in the source definition, not just its tactic.
Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
Enable the collection sources above and verify a benign baseline reaches the detector.
Run only the approved isolated scenario; capture native events and an independent behavior observable.
Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.

Synthetic logs and offline contract check

Download synthetic collection fixture (JSON) · Download the complete engineering workbook

This fixture exercises the listed collection fields. It does not reproduce System Information Discovery, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.

Not run in this browser. No network scan or attack command is executed by this control.

Validation status and remaining work

Source identity: Joined by exact technique/object IDs against hash-pinned sources.
Collection fixture: Available for offline schema exercises; not attack emulation.
Native telemetry / backend / real attack: Not validated for these imported procedures. Source fidelity and page tests cannot establish sensor or detector effectiveness.

All-page audit and evidence inventory · This page’s machine-readable workbook

Sources and evidence boundaries

Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.

Connected ecosystem references

Detection and collection

T1082 detection workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.

T1082 System Information Discovery — Attack Simulation

Complete technique description

Detection telemetry and configuration

Providers and collection configuration

Illustrative collection event

Providers and collection configuration

Illustrative collection event

Providers and collection configuration

Illustrative collection event

Providers and collection configuration

Illustrative collection event

Detection rules and analytic guidance

Before treating a rule as coverage

Anomaly-based detection

Anomaly engineering worksheet

Attack tools and documented software

Software observed in source procedures

Simulation design and documented procedures

Source-defined inputs

Source-defined inputs

Source-defined inputs

Source-defined inputs

Technique-specific experiment contract

Synthetic logs and offline contract check

Validation status and remaining work

Sources and evidence boundaries

Connected ecosystem references

Linked tags

Detection and collection

Related attack-tool pages

Threat actor context

Existing research