Before an intruder decides what to do on a machine, they usually ask it a few questions. MITRE ATT&CK lists this as System Information Discovery (T1082) in the discovery tactic. It applies to ESXi, IaaS, Linux, macOS, Network Devices and Windows.
How attackers use it
MITRE says an adversary may try to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs and architecture. The results may shape what comes next, such as whether the adversary fully infects the target or attempts specific actions. MITRE separates this from local storage discovery, which is about drives, disks and volumes.
The page names several ways the information is collected:
- The Systeminfo tool on Windows.
- The systemsetup configuration tool on macOS, when running with privileged access.
- Network device command line interfaces, for example show version.
- esxcli utilities on ESXi servers, such as system hostname get and system version get.
- Cloud APIs. On IaaS providers such as AWS, GCP and Azure, successful authenticated API calls can return the operating system platform and status of an instance or the model view of a virtual machine.
MITRE adds that this discovery, combined with other reconnaissance, can drive payload development and concealment.
How to detect it
MITRE states that this technique cannot be easily mitigated with preventive controls, because it abuses system features. Detection is the main lever. Its strategy (DET0525) lists these signals:
- Windows: processes that inspect the environment and then read OS configuration APIs or registry locations that expose version, architecture, patch level or hardware.
- Linux: system enumeration commands such as uname, df, uptime, hostname, lscpu and cat /etc/os-release, run from a terminal or scripts.
- macOS: utilities such as systemsetup, sw_vers, uname or sysctl run by terminal or scripted processes.
- ESXi: esxcli system hostname get, system version get or hardware commands run over SSH or a local shell.
- Cloud: API calls such as EC2 DescribeInstances or Azure VM inventory used to enumerate configurations across assets.
- Network devices: show version, show hardware or show system over SSH or console.
These commands are common for administrators, so a single run means little. Look for bursts, for unusual parents such as a document viewer or web server spawning them, and for service accounts doing it.
How to reduce the risk
Since prevention is limited, reduce the value of what is learned and speed up detection. Keep systems patched so that version details reveal less. Restrict who can call cloud inventory APIs, and log all calls. Restrict SSH and console access to network devices and ESXi hosts.
Check your own environment
On Windows, confirm that process creation auditing is on, since command line detection depends on it:
auditpol /get /category:"Detailed Tracking"
Also check that your tooling captures command lines for process creation events, whether through Security event 4688 with command line logging enabled or through Sysmon.
Quick check
Which cloud API call does MITRE give as an example of IaaS system discovery?
EC2 DescribeInstances on AWS, or the VM inventory in Azure, used to enumerate system configurations across assets.
Sources
- MITRE ATT&CK, T1082 System Information Discovery: https://attack.mitre.org/techniques/T1082/
