MITRE ATT&CKtechnique

T1082 System Information Discovery

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version
3.0
Created
2017-05-31

Description

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (437)

  • S9063 DEEPROOT software (malware)
  • S9067 TWOSTROKE software (malware)
  • S9059 MiniBike software (malware)
  • S9052 MiniFast software (malware)
  • S9053 MiniJunk software (malware)
  • S9050 Vidar software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9045 BACKUPOSINT v9.0 APEX PREDATOR software (malware)
  • S9046 IOControl software (malware)
  • G1057 ShinyHunters group
  • S9043 Mini Shai-Hulud software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9039 LazyWiper software (malware)
  • S9035 LAMEHUG software (malware)
  • S9037 RustyWater software (malware)
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • G1055 VOID MANTICORE group
  • S9029 IronWind software (malware)
  • S9031 AshTag software (malware)
  • S9034 Tsundere Botnet software (malware)
  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • S9023 HiddenFace software (malware)
  • S9024 SPAWNCHIMERA software (malware)
  • S9025 NOOPLDR software (malware)
  • S9019 PureCrypter software (malware)
  • S9010 GlassWorm software (malware)
  • S9008 Shai-Hulud software (malware)
  • S9002 Diskpart software (tool)
Show all 437 ›

Referenced by CAPEC · att&ck technique (3)

  • CAPEC-312 Active OS Fingerprinting attack pattern
  • CAPEC-313 Passive OS Fingerprinting attack pattern
  • CAPEC-580 System Footprinting attack pattern

References