| name | T1082_system-information-discovery |
| description | An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1082","discovery","esxi","iaas","linux","macos","network-devices","windows"] |
| technique_id | T1082 |
| tactic | discovery |
| all_tactics | ["discovery"] |
| platforms | ["ESXi","IaaS","Linux","macOS","Network Devices","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1082 |
| tech_stack | ["esxi","cloud","linux","macos","network devices","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
T1082 System Information Discovery
High-Level Description
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as system hostname get and system version get.
Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.
System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.
Kill Chain Phase
Platforms: ESXi, IaaS, Linux, macOS, Network Devices, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: System Information Discovery
Identify System Info. Upon execution, system info and time info will be displayed.
windows
