T1082 — System Information Discovery

Tactic: Discovery · Platforms: ESXi, IaaS, Linux, macOS, Network Devices, Windows

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target…

Sigma detection rules (6)

title: T1082 System Information Discovery
id: eaf2ab32-17ab-4c80-a57f-be6ad939f084
description: 'System Discovery via Native and Remote Utilities. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1082
author: Shahrukh Khan
date: 2026-02-10
license: MIT
tags:
  - attack.discovery
  - attack.t1082

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\systeminfo.exe'
      - '\hostname.exe'

  selection_ps:
    CommandLine|contains: 'Get-ComputerInfo'

  condition: 1 of selection*

falsepositives:
  - Extremely common benign system-information gathering.

level: informational

title: T1082 System Information Discovery
id: be5d24d8-dc17-4920-a59c-b853cbb05b73
description: 'System Discovery via Native and Remote Utilities. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandList, TerminalSessionID.'
references:
  - https://attack.mitre.org/techniques/T1082
author: Shahrukh Khan
date: 2026-04-03
license: MIT
tags:
  - attack.discovery
  - attack.t1082

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/uname'
      - '/hostnamectl'
      - '/lsb_release'
    a1|contains: '-a'
  selection_release:
    type: EXECVE
    a0|endswith: '/cat'
    a1: '/etc/os-release'

  condition: 1 of selection*

falsepositives:
  - uname/hostnamectl/os-release checks are routine, benign discovery commands used by monitoring agents, installers, and admins.

level: informational

title: T1082 System Information Discovery
id: ce40df1a-3356-402c-854d-75d63e59e2f8
description: 'System Discovery via Native and Remote Utilities. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcess, FrequencyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1082
author: Shahrukh Khan
date: 2026-04-03
license: MIT
tags:
  - attack.discovery
  - attack.t1082

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/sw_vers'
      - '/system_profiler'
      - '/sysctl'

  condition: selection

falsepositives:
  - Administrative scripts, support tooling, and MDM inventory checks routinely query system information this way.

level: informational

title: T1082 System Information Discovery
id: 681043a7-3dad-471c-b5c8-1aaa3f22bcd7
description: 'System Discovery via Native and Remote Utilities. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: IAMRoleContext, APIFrequency.'
references:
  - https://attack.mitre.org/techniques/T1082
author: Shahrukh Khan
date: 2026-05-22
license: MIT
tags:
  - attack.discovery
  - attack.t1082

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource:
      - 'ec2.amazonaws.com'
      - 'sts.amazonaws.com'
    eventName:
      - 'DescribeInstances'
      - 'DescribeImages'
      - 'DescribeAccountAttributes'
      - 'GetCallerIdentity'
      - 'DescribeRegions'
  filter_service_principal:
    userIdentity.type: 'AWSService'

  condition: selection and not filter_service_principal

falsepositives:
  - These are among the most frequent read-only API calls made by CLI tooling, CI/CD pipelines, and inventory systems, so this rule is only useful for volume-based anomaly detection, not single-event alerting.

level: informational

title: T1082 System Information Discovery
id: 257806b3-adc2-46d6-b955-80ea97568b5b
description: 'System Discovery via Native and Remote Utilities. (Data Component: Command Execution; baseline tier: fallback.) Tune using: Username, CommandList.'
references:
  - https://attack.mitre.org/techniques/T1082
author: Shahrukh Khan
date: 2026-01-16
license: MIT
tags:
  - attack.discovery
  - attack.t1082

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/uname'
      - '/hostnamectl'
      - '/lsb_release'
      - '/dmidecode'

  condition: selection

falsepositives:
  - System information gathering commands are used constantly by monitoring agents, provisioning scripts, and support staff.

level: informational

title: T1082 System Information Discovery
id: 6de670dc-6cae-45bb-a41e-b95c51ea0231
description: 'System Discovery via Native and Remote Utilities. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SessionOrigin, CommandString.'
references:
  - https://attack.mitre.org/techniques/T1082
author: Shahrukh Khan
date: 2026-01-12
license: MIT
tags:
  - attack.discovery
  - attack.t1082

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli system version get'
      - 'vim-cmd hostsvc/hostsummary'
      - 'uname -a'

  condition: selection

falsepositives:
  - Routine health-check scripts and support diagnostic bundle generation frequently run these same discovery commands.

level: informational

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1082 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan