T1082 System Information Discovery

Technique: T1082
Tactics: Discovery
Research, 90 days: 15
KEV CVEs mapped: 7
SigmaHQ rules: 33
Elastic, Splunk: 66
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1082

MITRE description

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is an adversary's discovery of local drive, disks and/or volumes. Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the <code>systemsetup</code> configuration tool on macOS. Adversaries may leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. <code>show version</code>).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis) Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-11-03 Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure
2026-10-30 Microsoft Threat Intelligence: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
2026-10-30 Darktrace: CikaBika Bot: Inside a Discord RAT Campaign
2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
2026-10-15 Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering
2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
2026-10-08 Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
2026-10-06 Flare: CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery
2026-10-02 Group-IB: Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino

Showing the 10 most recent of 15.

Detection coverage

SigmaHQ community rules

CMD Shell Output Redirect (threat-hunting)
System Information Discovery Via Wmic.EXE (threat-hunting)
Bitbucket User Details Export Attempt Detected (core)
Bitbucket User Permissions Export Attempt (core)
System Information Discovery - Auditd (core)
System and Hardware Information Discovery (core)
System Info Discovery via Sysinfo Syscall (core)
OS Architecture Discovery Via Grep (core)
Potential GobRAT File Discovery Via Grep (core)
Container Residence Discovery Via Proc Virtual FS (core)
Docker Container Discovery Via Dockerenv Listing (core)
Potential Container Discovery Via Inodes Listing (core)
System Information Discovery (core)
System Information Discovery Using Ioreg (core)
System Information Discovery Using sw_vers (core)
System Information Discovery Via Sysctl - MacOS (core)
System Information Discovery Using System_Profiler (core)
Cisco Discovery (core)
HackTool - WinPwn Execution - ScriptBlock (core)
System Information Discovery via Registry Queries (core)
Suspicious Kernel Dump Using Dtrace (core)
HackTool - PCHunter Execution (core)
HackTool - winPEAS Execution (core)
HackTool - WinPwn Execution (core)
Suspicious Execution of Hostname (core)

Showing 25 of 33 community rules. the full set is tagged attack.t1082 in SigmaHQ.

Elastic and Splunk rules

Azure WireServer Unusual Process Connection (elastic)
Suspicious Instance Metadata Service (IMDS) API Command Line Execution (elastic)
Suspicious Instance Metadata Service (IMDS) API Request (elastic)
Virtual Machine Fingerprinting via Grep (elastic)
Suspicious React Server Child Process (elastic)
Shell or Suspicious Process Spawned by Ray Worker (elastic)
Entra ID Sign-in BloodHound Suite User-Agent Detected (elastic)
Entra ID Sign-in TeamFiltration User-Agent Detected (elastic)
Environment Variable Enumeration Detected via Defend for Containers (elastic)
Privilege Boundary Enumeration Detected via Defend for Containers (elastic)
Service Account Namespace Read Detected via Defend for Containers (elastic)
ESXi System and Account Enumeration (elastic)
Suspicious Kernel Feature Activity (elastic)
System Information Discovery via dmidecode from Parent Shell (elastic)
Kernel Instrumentation Discovery via kprobes and tracefs (elastic)
Unusual Kernel Module Enumeration (elastic)
Kernel Seeking Activity (elastic)
Kernel Unpacking Activity (elastic)
Hping Process Activity (elastic)
Manual Mount Discovery via /etc/exports or /etc/fstab (elastic)
Pluggable Authentication Module (PAM) Version Discovery (elastic)
Passwordless Sudo Probing (elastic)
Polkit Version Discovery (elastic)
Suspicious which Enumeration (elastic)
Virtual Machine Fingerprinting (elastic)

Showing 25 of 66.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.