1200kmSECURITY RESEARCH
Loading interactive filters…

1200KM / simulation

T1082 System Information Discovery — Attack Simulation

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or…

Technique description

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Connected ecosystem references

Linked tags

enterprisecloudcloud-hosted-endpointnetwork-infrastructureonpremvirtualizationESXiIaaSLinuxmacOSNetwork DevicesWindowsdiscoveryisolated_authorized_labprocedure_review_requiredtelemetry_configuration_requireddisposable_tenant_and_cost_controlssome_candidates_require_elevation
can_simulatetechniquesource_mapped

Detection and collection

T1082 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.