System Information Discovery

What is System Information Discovery?

“System Information Discovery is documented as technique T1082 in MITRE ATT&CK® v19.1 under the Discovery tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify System Information Discovery activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Hunt on the full command line. Event 4688 leaves Process Command Line empty until the "Include command line in process creation events" policy is enabled; Sysmon Event ID 1 logs the command line, the parent image and a ProcessGUID. SigmaHQ's own levels show how much one command is worth: systeminfo.exe execution is low, wmic with os get Caption,OSArchitecture,Version is medium, and uname, hostname, lscpu, lsmod or dmidecode on Linux is informational. Treat a hit as context for another alert rather than a reason to page someone.

2. 2

   Escalate the burst. One systeminfo from an admin console is noise. systeminfo, whoami, ipconfig /all and net user run from the same parent within a few minutes is someone taking stock of a fresh foothold, and it gets worse when that parent is an Office application, w3wp.exe, a script host or an unsigned binary under AppData. Group Sysmon Event ID 1 records by ParentProcessGuid to see the whole burst in one row.

3. 3

   Look for output written to a file. MITRE's procedure example for admin@338 is ver >> %temp%\download followed by systeminfo >> %temp%\download after a LOWBALL infection, so the operator can pull one file back later. A cmd.exe command line that appends systeminfo output into Temp or C:\Users\Public is staging the results for collection.

4. 4

   Typed into an open PowerShell session, Get-ComputerInfo (Windows PowerShell 5.1 and later) returns system and operating system properties in one object and starts no new process, so 4688 and Sysmon see only powershell.exe. Script block logging (event 4104) is where the cmdlet name shows up, and MITRE lists it as a PoshC2 module for system enumeration.

5. 5

   Alert on registry queries targeting version and configuration information from SOFTWARE\Microsoft\Windows NT\CurrentVersion and SYSTEM\CurrentControlSet\Control\Session Manager\Environment from unusual processes.

6. 6

   Detect WMI queries for Win32_OperatingSystem, Win32_ComputerSystem, and Win32_BIOS classes from non-administrative processes and from remote WMI connections originating from workstations.

7. 7

   On Linux, watch for uname -a, uname -r, lscpu and dmidecode in process events from web server or service accounts; MITRE cites the IOCONTROL malware running uname -v and uname -r for kernel version and release. On ESXi, MITRE describes the same step through esxcli system hostname get and esxcli system version get.

Example Alerts

These realistic alert examples show what System Information Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect System Information Discovery?

Detection centers on XDR, SIEM telemetry for the discovery phase of the attack. Hunt on the full command line. Event 4688 leaves Process Command Line empty until the "Include command line in process creation events" policy is enabled; Sysmon Event ID 1 logs the command line, the parent image and a ProcessGUID. SigmaHQ's own levels show how much one command is worth: systeminfo.exe execution is low, wmic with os get Caption,OSArchitecture,Version is medium, and uname, hostname, lscpu, lsmod or dmidecode on Linux is informational. Treat a hit as context for another alert rather than a reason to page someone. Escalate the burst. One systeminfo from an admin console is noise. systeminfo, whoami, ipconfig /all and net user run from the same parent within a few minutes is someone taking stock of a fresh foothold, and it gets worse when that parent is an Office application, w3wp.exe, a script host or an unsigned binary under AppData. Group Sysmon Event ID 1 records by ParentProcessGuid to see the whole burst in one row.

What does a System Information Discovery alert look like?

A representative SIEM detection is "Systeminfo Collection Across Multiple Systems" (medium severity): WMI-based remote execution detected collecting systeminfo output from 23 systems sequentially using a single compromised domain account. The collected information includes OS versions, installed patches, hardware specifications, and domain membership. Systematic collection of this data across multiple systems simultaneously is characteristic of post-exploitation framework reconnaissance modules preparing a target profile for subsequent exploitation and lateral movement.

Which tools detect System Information Discovery, and how can I practice?

System Information Discovery (T1082) is best surfaced with XDR, SIEM telemetry, which exposes the discovery signals described above. There is no dedicated SOCSimulator room for it yet; practice the surrounding detection skills on those consoles in SOCSimulator Operations, free.