System Information Discovery

What is System Information Discovery?

“System Information Discovery is documented as technique T1082 in MITRE ATT&CK® v19.1 under the Discovery tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify System Information Discovery activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor execution of systeminfo.exe, ver, and winver commands in isolation or as part of broader discovery command sequences, particularly from accounts that do not have legitimate administrative reasons to query system configuration.

2. 2

   Alert on registry queries targeting version and configuration information from SOFTWARE\Microsoft\Windows NT\CurrentVersion and SYSTEM\CurrentControlSet\Control\Session Manager\Environment from unusual processes.

3. 3

   Detect WMI queries for Win32_OperatingSystem, Win32_ComputerSystem, and Win32_BIOS classes from non-administrative processes and from remote WMI connections originating from workstations.

4. 4

   Monitor for automated system information collection that writes output to files in staging directories, as attackers frequently redirect discovery command output to text files that are later exfiltrated or analyzed to plan further attack stages.

5. 5

   Track execution of commands collecting patch and hotfix information including wmic qfe list and Get-HotFix, which attackers use to identify unpatched vulnerabilities that can be exploited for privilege escalation.

Example Alerts

These realistic alert examples show what System Information Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect System Information Discovery?

Detection centers on XDR, SIEM telemetry for the discovery phase of the attack. Monitor execution of systeminfo.exe, ver, and winver commands in isolation or as part of broader discovery command sequences, particularly from accounts that do not have legitimate administrative reasons to query system configuration. Alert on registry queries targeting version and configuration information from SOFTWARE\Microsoft\Windows NT\CurrentVersion and SYSTEM\CurrentControlSet\Control\Session Manager\Environment from unusual processes.

What does a System Information Discovery alert look like?

A representative SIEM detection is "Systeminfo Collection Across Multiple Systems" (medium severity): WMI-based remote execution detected collecting systeminfo output from 23 systems sequentially using a single compromised domain account. The collected information includes OS versions, installed patches, hardware specifications, and domain membership. Systematic collection of this data across multiple systems simultaneously is characteristic of post-exploitation framework reconnaissance modules preparing a target profile for subsequent exploitation and lateral movement.

Which tools detect System Information Discovery, and how can I practice?

System Information Discovery (T1082) is best surfaced with XDR, SIEM telemetry, which exposes the discovery signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.