System Information Discovery detection rulesT1082

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

windows · process_creation

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

windows · process_creation

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

windows · process_creation

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

windows · ps_script

Detects a set of suspicious network related commands often used in recon stages

windows · process_creation

Detects the use of grep to discover specific files created by the GobRAT malware

linux · process_creation

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

windows · process_creation

Detects user data export activity.

bitbucket

Detects user permission data export attempt.

bitbucket

Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms. This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.

windows · process_creation

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

windows · process_creation

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

windows · process_creation

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the 'wmic' command-line utility and has been observed being used by threat actors such as Volt Typhoon.

windows · process_creation

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

macos · process_creation

Detects the use of "sw_vers" for system information discovery

macos · process_creation

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

macos · process_creation

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

macos · process_creation

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.

windows · process_creation

Find information about network devices that is not stored in config files

cisco

Detects the use of the redirection character ">" to redirect information on the command line. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

windows · process_creation

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

linux · process_creation

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

linux · process_creation

Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"

linux · process_creation

Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

linux · process_creation

Use of hostname to get information

windows · process_creation

Detects usage of the "systeminfo" command to retrieve information

windows · process_creation

Use of reg to get MachineGuid information

windows · process_creation

Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.

linux

Detects System Information Discovery commands

linux

Detects attempts to query system information directly from the Windows Registry.

windows · process_creation

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS, and GPU driver products/versions.

windows · process_creation

Detects system information discovery commands

linux

Detects system information discovery commands

linux · process_creation