Description
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as system hostname get and system version get.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis)
Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)
System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)
Platforms
Threat Groups (58)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has attempted to get detailed information about a compromised host, including the operating system, ver... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) used various system commands and tools to pull system information during operations.(Citation: FBI ... |
| G1008 | SideCopy | [SideCopy](https://attack.mitre.org/groups/G1008) has identified the OS version of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021) |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has a tool that can obtain information about the local system.(Citation: Symantec Buckeye)(Citation: evo... |
| G1020 | Mustard Tempest | [Mustard Tempest](https://attack.mitre.org/groups/G1020) has used implants to perform system reconnaissance on targeted systems.(Citation: Microsoft R... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has enumerated OS type, OS version, and other information using a script or the "systeminfo" command.... |
| G0018 | admin@338 | [admin@338](https://attack.mitre.org/groups/G0018) actors used the following commands after exploiting a machine with [LOWBALL](https://attack.mitre.o... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) collected the victim computer name, OS version, and architecture type and sent the information to i... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) uses multiple built-in commands such as <code>systeminfo</code> and `net config Workstation` to enumera... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has collected the OS version and computer name from victims. One of the group's backdoors can also quer... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that can collect the victim’s OS version and machine name.(Citation: Securelist M... |
| G0047 | Gamaredon Group | A [Gamaredon Group](https://attack.mitre.org/groups/G0047) file stealer can gather the victim's computer name and drive serial numbers to send to a C2... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has searched for system version, architecture, and hostname information.(Citation: ATT TeamTNT Chimae... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has used csvde.exe, which is a built-in Windows command line tool, to export system information. Additio... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) used a backdoor to enumerate information about the infected system's operating system.(Citation... |
| G0026 | APT18 | [APT18](https://attack.mitre.org/groups/G0026) can collect system information from the victim’s machine.(Citation: PaloAlto DNS Requests May 2016) |
| G1012 | CURIUM | [CURIUM](https://attack.mitre.org/groups/G1012) deploys information gathering tools focused on capturing IP configuration, running application, system... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used tools to collect the computer name, OS version, installed hotfixes, as well as informatio... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has gathered system information using <code>systeminfo</code>.(Citation: Avira Mustang Panda Ja... |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used a tool to capture the processor architecture of a compromised host in order to register it... |
Associated Software (355)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware in... |
| S0139 | PowerDuke | Malware | [PowerDuke](https://attack.mitre.org/software/S0139) has commands to get information about the victim's name, build, version, serial number, and memor... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has collected from a victim machine the system name, processor information, and OS version.(Cit... |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) can obtain the computer name and information on the OS from targeted hosts.(Citation: Kaspersky Toddy... |
| S1145 | Pikabot | Malware | [Pikabot](https://attack.mitre.org/software/S1145) performs a variety of system checks and gathers system information, including commands such as <cod... |
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) can gather system information from a compromised host.(Citation: Profero APT27 December 2020) |
| S0543 | Spark | Malware | [Spark](https://attack.mitre.org/software/S0543) can collect the hostname, keyboard layout, and language from the system.(Citation: Unit42 Molerat Mar... |
| S0242 | SynAck | Malware | [SynAck](https://attack.mitre.org/software/S0242) gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if i... |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can enumerate the OS version and domain on a targeted system.(Citation: Google EXOTIC LILY March ... |
| S0233 | MURKYTOP | Malware | [MURKYTOP](https://attack.mitre.org/software/S0233) has the capability to retrieve information about the OS.(Citation: FireEye Periscope March 2018) |
| S0417 | GRIFFON | Malware | [GRIFFON](https://attack.mitre.org/software/S0417) has used a reconnaissance module that can be used to retrieve information about a victim's computer... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) has collected the computer name and OS version from a compromised machine.(Citation: Korean FSI TA50... |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) collects the OS version, country name, MAC address, computer name, and physical memory statistics.... |
| S0229 | Orz | Malware | [Orz](https://attack.mitre.org/software/S0229) can gather the victim OS version and whether it is 64 or 32 bit.(Citation: Proofpoint Leviathan Oct 201... |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) can gather information on the operating system on the victim’s machine.(Citation: Unit 42 NOKKI Sept ... |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) gathers the computer name, CPU information, Microsoft Windows version, and runs the command <code>syste... |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) collects information about the OS and computer name.(Citation: Symantec Dragonfly)(Citation... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) collects system information including computer and domain names, OS version, and S7P paths.(Citatio... |
| S9029 | IronWind | Malware | [IronWind](https://attack.mitre.org/software/S9029) can capture the OS version and computer name of the compromised host.(Citation: Check Point Wirte ... |
| S1078 | RotaJakiro | Malware | [RotaJakiro](https://attack.mitre.org/software/S1078) executes a set of commands to collect device information, including `uname`. Another example is... |
References
- Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.
- Google. (n.d.). Rest Resource: instance. Retrieved March 3, 2020.
- Jason Hill. (2023, February 8). VMware ESXi in the Line of Ransomware Fire. Retrieved March 26, 2025.
- Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.
- Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved October 8, 2019.
- Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
- Phile Stokes. (2018, September 20). On the Trail of OSX.FairyTale | Adware Playing at Malware. Retrieved August 24, 2021.
- US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Frequently Asked Questions
What is T1082 (System Information Discovery)?
T1082 is a MITRE ATT&CK technique named 'System Information Discovery'. It belongs to the Discovery tactic(s). An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this informatio...
How can T1082 be detected?
Detection of T1082 (System Information Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1082?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1082?
Known threat groups using T1082 include: APT38, BlackByte, SideCopy, APT3, Mustard Tempest, Kimsuky, admin@338, Patchwork.