OpenTrojan Intelligence Infrastructure
Search intelligence, CVEs, threats… Search
Ask AI Analyst API
English中文
Enter Portal

T1082: System Information Discovery

Discovery Intelligence Profile

AI Answer

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is (Source: MITRE ATT&CK T1082)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

FieldValue
Technique IDT1082
NameSystem Information Discovery
TacticDiscovery (discovery)
PlatformsESXi, IaaS, Linux, macOS, Network Devices, Windows
Sub-techniqueNo

Why it matters

In the OpenTrojan knowledge graph, System Information Discovery (T1082) is one of the highest-connectivity ATT&CK techniques: 427 MITRE STIX relationships reference this technique; 58 threat groups observed using it; 355 software families associated; 14 campaigns associated; 2 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1082). An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary’s discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as system hostname get and system version get. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.

Detection

DET0525 System Discovery via Native and Remote Utilities AN1452 Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup. AN1453 Execution of system enumeration commands such as uname , df , uptime , hostname , lscpu , and cat /etc/os-release through local terminal or scripts. AN1454 Execution of system info utilities like systemsetup , sw_vers , uname , or sysctl by terminal or scripted processes. AN1455 Execution of esxcli system hostname get , esxcli system version get , or esxcli hardware commands through SSH or local shell. AN1456 Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets. AN1457 Execution of show version , show hardware , or show system commands through CLI via SSH or console.

Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1082).

Mitigation

Not available — no MITRE course-of-action was found for this technique in the ingested dataset.

  • TrickBot
  • PowerDuke
  • BLINDINGCAN
  • Ninja
  • Pikabot
  • RCSession
  • Spark
  • SynAck
  • Bumblebee
  • MURKYTOP
  • GRIFFON
  • Amadey

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

  • APT38
  • BlackByte
  • SideCopy
  • APT3
  • Mustard Tempest
  • Kimsuky
  • admin@338
  • Patchwork
  • APT41
  • APT32
  • MuddyWater
  • Gamaredon Group

Group associations are from MITRE ATT&CK STIX relationships.

  • KV Botnet Activity
  • SharePoint ToolShell Exploitation
  • Frankenstein
  • RedDelta Modified PlugX Infection Chain Operations
  • Operation Honeybee
  • Cutting Edge
  • Anthropic AI-orchestrated Campaign
  • Juicy Mix
  • Operation AkaiRyū
  • FunnyDream
  • Operation CuckooBees
  • ArcaneDoor

Campaign associations are from MITRE ATT&CK STIX relationships.

Related Content

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Related Entities

Start Investigation

Move from reading to investigating T1082 System Information Discovery. The workspace is a structured analysis surface — not a chat — organised as:

  1. Question — what do you need to know about T1082 System Information Discovery?
  2. Evidence — assertions mapped to verifiable references.
  3. Timeline — events in chronological order.
  4. Related Entities — CVE, threat actor, campaign, malware links.
  5. Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
  6. Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace