# T1082 - System Information Discovery

## Description from ATT&CK

> An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is an adversary's discovery of local drive, disks and/or volumes.
> 
> Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the <code>systemsetup</code> configuration tool on macOS. Adversaries may leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. <code>show version</code>).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis)
> 
> Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)
> 
> [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)

[Source](https://attack.mitre.org/techniques/T1082)

## Atomic Tests

- [Atomic Test #1: System Information Discovery](#atomic-test-1-system-information-discovery)
- [Atomic Test #2: System Information Discovery](#atomic-test-2-system-information-discovery)
- [Atomic Test #3: List OS Information](#atomic-test-3-list-os-information)
- [Atomic Test #4: Linux VM Check via Hardware](#atomic-test-4-linux-vm-check-via-hardware)
- [Atomic Test #5: Linux VM Check via Kernel Modules](#atomic-test-5-linux-vm-check-via-kernel-modules)
- [Atomic Test #6: FreeBSD VM Check via Kernel Modules](#atomic-test-6-freebsd-vm-check-via-kernel-modules)
- [Atomic Test #7: Hostname Discovery (Windows)](#atomic-test-7-hostname-discovery-windows)
- [Atomic Test #8: Hostname Discovery](#atomic-test-8-hostname-discovery)
- [Atomic Test #9: Windows MachineGUID Discovery](#atomic-test-9-windows-machineguid-discovery)
- [Atomic Test #10: Griffon Recon](#atomic-test-10-griffon-recon)
- [Atomic Test #11: Environment variables discovery on windows](#atomic-test-11-environment-variables-discovery-on-windows)
- [Atomic Test #12: Environment variables discovery on freebsd, macos and linux](#atomic-test-12-environment-variables-discovery-on-freebsd-macos-and-linux)
- [Atomic Test #13: Show System Integrity Protection status (MacOS)](#atomic-test-13-show-system-integrity-protection-status-macos)
- [Atomic Test #14: WinPwn - winPEAS](#atomic-test-14-winpwn---winpeas)
- [Atomic Test #15: WinPwn - itm4nprivesc](#atomic-test-15-winpwn---itm4nprivesc)
- [Atomic Test #16: WinPwn - Powersploits privesc checks](#atomic-test-16-winpwn---powersploits-privesc-checks)
- [Atomic Test #17: WinPwn - General privesc checks](#atomic-test-17-winpwn---general-privesc-checks)
- [Atomic Test #18: WinPwn - GeneralRecon](#atomic-test-18-winpwn---generalrecon)
- [Atomic Test #19: WinPwn - Morerecon](#atomic-test-19-winpwn---morerecon)
- [Atomic Test #20: WinPwn - RBCD-Check](#atomic-test-20-winpwn---rbcd-check)
- [Atomic Test #21: WinPwn - PowerSharpPack - Watson searching for missing windows patches](#atomic-test-21-winpwn---powersharppack---watson-searching-for-missing-windows-patches)
- [Atomic Test #22: WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors](#atomic-test-22-winpwn---powersharppack---sharpup-checking-common-privesc-vectors)
- [Atomic Test #23: WinPwn - PowerSharpPack - Seatbelt](#atomic-test-23-winpwn---powersharppack---seatbelt)
- [Atomic Test #24: Azure Security Scan with SkyArk](#atomic-test-24-azure-security-scan-with-skyark)
- [Atomic Test #25: Linux List Kernel Modules](#atomic-test-25-linux-list-kernel-modules)
- [Atomic Test #26: FreeBSD List Kernel Modules](#atomic-test-26-freebsd-list-kernel-modules)
- [Atomic Test #27: System Information Discovery with WMIC](#atomic-test-27-system-information-discovery-with-wmic)
- [Atomic Test #28: System Information Discovery](#atomic-test-28-system-information-discovery)
- [Atomic Test #29: Check computer location](#atomic-test-29-check-computer-location)
- [Atomic Test #30: BIOS Information Discovery through Registry](#atomic-test-30-bios-information-discovery-through-registry)
- [Atomic Test #31: ESXi - VM Discovery using ESXCLI](#atomic-test-31-esxi---vm-discovery-using-esxcli)
- [Atomic Test #32: ESXi - Darkside system information discovery](#atomic-test-32-esxi---darkside-system-information-discovery)
- [Atomic Test #33: sysctl to gather macOS hardware info](#atomic-test-33-sysctl-to-gather-macos-hardware-info)
- [Atomic Test #34: operating system discovery ](#atomic-test-34-operating-system-discovery-)
- [Atomic Test #35: Check OS version via "ver" command](#atomic-test-35-check-os-version-via-ver-command)
- [Atomic Test #36: Display volume shadow copies with "vssadmin"](#atomic-test-36-display-volume-shadow-copies-with-vssadmin)
- [Atomic Test #37: Identify System Locale and Regional Settings with PowerShell](#atomic-test-37-identify-system-locale-and-regional-settings-with-powershell)
- [Atomic Test #38: Enumerate Available Drives via gdr](#atomic-test-38-enumerate-available-drives-via-gdr)
- [Atomic Test #39: Discover OS Product Name via Registry](#atomic-test-39-discover-os-product-name-via-registry)
- [Atomic Test #40: Discover OS Build Number via Registry](#atomic-test-40-discover-os-build-number-via-registry)

### Atomic Test #1: System Information Discovery

Identify System Info. Upon execution, system info and time info will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `66703791-c902-4560-8770-42b8a91f7667`

#### Attack Commands: Run with `command_prompt`!

```cmd
systeminfo
reg query HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum
```

### Atomic Test #2: System Information Discovery

Identify System Info

**Supported Platforms:** macOS

**auto_generated_guid:** `edff98ec-0f73-4f63-9890-6b117092aff6`

#### Attack Commands: Run with `sh`!

```sh
system_profiler
ls -al /Applications
```

### Atomic Test #3: List OS Information

Identify System Info

**Suppo