sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
HAWKBALL can collect the OS version, architecture information, and computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
HELLOKITTY can enumerate logical drives on a target system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
HOPLIGHT has been observed collecting victim machine information like OS version, volume information, and more.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
HermeticWiper can determine the OS version, bitness, and enumerate physical drives on a targeted host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Heyoka Backdoor can enumerate drives on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Hildegard has collected the host's OS, CPU, and memory information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
IcedID has the ability to identify the computer name and OS version on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Industroyer collects the victim machine’s Windows GUID.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
InnaputRAT gathers volume drive information and system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
InvisiMole can gather information on the mapped drives, OS version, computer name, DEP policy, memory size, and system volume serial number.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Ixeshe collects the computer name of the victim's system during the initial infection.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key `HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum`. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
JPIN can obtain system information such as OS version and disk space.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
KARAE can collect system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, disk devices, and time elapsed since system start.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
KGH_SPY can collect drive information from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
KOMPROGO is capable of retrieving information about the infected system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
KONNI can gather the OS version, architecture information, connected drives, hostname, RAM size, and disk space information from the victim’s machine and has used `cmd /c systeminfo` command to get a snapshot of the current system state of the target machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
KOPILUWAK can discover logical drive information on compromised hosts.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Kasidet has the ability to obtain a victim's system name and operating system version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Kazuar gathers information on the system and local drives.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Kessel has collected the system architecture, OS version, and MAC address information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Kevin can enumerate the OS version and hostname of a targeted machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
KeyBoy can gather extended system information, such as information about the operating system, disks, and memory.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
KillDisk retrieves the hard disk name by calling the `CreateFileA to \\.\PHYSICALDRIVE0` API.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Kobalos can record the hostname and kernel version of the target machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands `systeminfo`, `net config workstation`, `hostname`, `ver`, `set`, and `date /t`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
LITTLELAMB.WOOLTEA can check the type of Ivanti VPN device it is running on by executing `first_run()` to identify the first four bytes of the motherboard serial number.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
LightNeuron gathers the victim computer name using the Win32 API call `GetComputerName`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Linfo creates a backdoor through which remote attackers can retrieve system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
LiteDuke can enumerate the CPUID and BIOS version on a compromised system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
LitePower has the ability to list local drives and enumerate the OS architecture.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Lizar can collect the computer name from the machine,.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Lokibot has the ability to discover the computer name and Windows product name/version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
LoudMiner has monitored CPU usage.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
MURKYTOP has the capability to retrieve information about the OS.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, macOS version, and disk sizes.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Machete collects the hostname of the target computer.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Mafalda can collect the computer name and enumerate all drives on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
MarkiRAT can obtain the computer name from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Metamorfo has collected the hostname and operating system version from the compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Meteor has the ability to discover the hostname of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Micropsia gathers the hostname and OS version from the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Milan can enumerate the targeted machine's name and GUID.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
MiniDuke can gather the hostname on a compromised machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
MirageFox can collect CPU and architecture information from the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
The initial beacon packet for Misdat contains the operating system version of the victim.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Mispadu collects the OS version, computer name, and language ID.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
MoleNet can collect information about the about the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Mongall can identify drives on compromised hosts and retrieve the hostname via `gethostbyname`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
MoonWind can obtain the victim hostname, Windows version, RAM amount, number of drives, and screen resolution.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
More_eggs has the capability to gather the OS version and computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
NETWIRE can discover and collect victim system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
NKAbuse conducts multiple system checks and includes these in subsequent "heartbeat" messages to the malware's command and control server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
NOKKI can gather information on drives and the operating system on the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Naid collects a unique identifier (UID) from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
NanHaiShu can gather the victim computer name and serial number.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
NavRAT uses `systeminfo` on a victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Nebulae can discover logical drive information including the drive type, free space, and volume information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Neoichor can collect the OS version and computer name from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Ninja can obtain the computer name and information on the OS and physical drives from targeted hosts.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
OSInfo discovers information about the infected machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command `sw_vers -productVersion`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the `ioreg` command to gather some of this information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
OceanSalt can collect the computer name from the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Octopus can collect system drive information, the computer name, the size of the disk, OS version, and OS architecture information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Okrum can collect computer name, locale information, and information about the OS and architecture.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Orz can gather the victim OS version and whether it is 64 or 32 bit.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
POORAIM can identify system information, including battery status.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
POWRUNER may collect information about the system by running `hostname` and `systeminfo` on a victim.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
PUNCHBUGGY can gather system information such as computer names.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Pay2Key has the ability to gather the hostname of the victim machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Penquin can report the file system type and disk space of a compromised host to C2.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
PinchDuke gathers system configuration information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
PingPull can retrieve the hostname of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
PipeMon can collect and send OS version and computer name as a part of its C2 beacon.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Pisloader has a command to collect victim system information, including the system name and OS version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
PoetRAT has the ability to gather information about the compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Pony has collected the Service Pack, language, and region information to send to the C2.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
PoshC2 contains modules, such as `Get-ComputerInfo`, for enumerating common system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
PowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
PowerShower has collected system information on the infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Proxysvc collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Pupy can grab a system’s information including the OS version, architecture, etc.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
QakBot can collect system information including the OS version and domain on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
QuasarRAT can gather system information from the victim’s machine including the OS type.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
RCSession can gather system information from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
REvil can identify the username, machine name, system language, keyboard layout, OS version, and system drive information on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
RTM can obtain the computer name, OS version, and default language identifier.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Reaver collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Revenge RAT collects the CPU information, OS information, and system language.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Rifdoor has the ability to identify the Windows version on the compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Rising Sun can detect the computer name, operating system, and drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
RotaJakiro executes a set of commands to collect device information, including `uname`.  Another example is the `cat /etc/*release | uniq` command used to collect the current OS distribution.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Royal can use `GetNativeSystemInfo` and `GetLogicalDrives` to enumerate system processors and logical drives.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
RunningRAT gathers the OS version, logical drives information, processor information, and volume information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Ryuk has called `GetLogicalDrives` to emumerate all mounted drives, and `GetDriveTypeW` to determine the drive type.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
The initial beacon packet for S-Type contains the operating system version and file system of the victim.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SDBbot has the ability to identify the OS version, OS bit information and computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SHUTTERSPEED can collect system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can collect information related to a compromised host, including OS version and a list of drives.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SLOTHFULMEDIA has collected system name, OS version, adapter information, memory usage, and disk information from a victim machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SLOWDRIFT collects and sends system information to its C2.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SMOKEDHAM has used the `systeminfo` command on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SOUNDBITE is capable of gathering system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
STARWHALE can gather the computer name of an infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SUNBURST collected hostname and OS version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SVCReady has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use of `systeminfo.exe`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SYSCON has the ability to use Systeminfo to identify system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Saint Bot can identify the OS version, CPU, and other details from a victim's machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Sardonic has the ability to collect the computer name, CPU manufacturer name, and C:\ drive serial number from a compromised machine. Sardonic also has the ability to execute the `ver` and `systeminfo` commands.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ServHelper will attempt to enumerate Windows version and system architecture.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ShadowPad has discovered system information including memory status, CPU frequency, OS versions, and volume serial numbers.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Shark can collect the GUID of a targeted machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SharpDisco can use a plugin to enumerate system drives.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SharpStage has checked the system settings to see if Arabic is the configured language.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SideTwist can collect the computer name of a targeted system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Snip3 has the ability to query `Win32_ComputerSystem` for system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SocGholish has the ability to enumerate system information including the victim computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SodaMaster can enumerate the host name and OS version on a target system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SombRAT can execute `getinfo` to enumerate the computer name and OS version of a compromised system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SoreFang can collect the hostname, operating system configuration, product ID, and disk space on victim machines by executing Systeminfo.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Spark can collect the hostname, keyboard layout, and language from the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SpeakUp uses the `cat /proc/cpuinfo | grep -c “cpu family” 2>&1` command to gather system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SpicyOmelette can identify the system name of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Squirrelwaffle has gathered victim computer information and configurations.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
StreamEx has the ability to enumerate system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
StrongPity can identify the hard disk volume serial number on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Stuxnet collects system information including computer and domain names, OS version, and S7P paths.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
SysUpdate can collect a system's architecture, operating system version, hostname, and drive information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Systeminfo can be used to gather information about the operating system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
TAINTEDSCRIBE can use `DriveList` to retrieve drive information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
TURNEDUP is capable of gathering system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
TYPEFRAME can gather the disk volume information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ThreatNeedle can collect system profile information from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Torisma can use `GetlogicalDrives` to get a bitmask of all drives available on a compromised system. It can also use `GetDriveType` to determine if a new drive is a CD-ROM drive.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
UPPERCUT has the capability to gather the system’s hostname and OS version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Uroburos has the ability to gather basic system information and run the POSIX API `gethostbyname`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Ursnif has used Systeminfo to gather system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
VERMIN collects the OS name, machine name, and architecture information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Valak can determine the Windows version and computer name on a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
WINDSHIELD can gather the victim computer name.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
WINERACK can gather information about the host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
WellMess can identify the computer name of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
WhisperGate has the ability to enumerate fixed logical drives on a targeted system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Woody RAT can retrieve the following information from an infected machine: OS, architecture, computer name, OS build version, environment variables, and storage drives.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
XAgentOSX contains the getInstalledAPP function to run `ls -la /Applications` to gather what applications are installed.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
XCSSET identifies the macOS version and uses `ioreg` to determine serial number.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
YAHOYAH checks for the system’s Windows OS version and hostname.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ZLib has the ability to enumerate system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Zebrocy collects the OS version, computer name and serial number for the storage volume C:\. Zebrocy also runs the `systeminfo` command to gather system information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
Zox can enumerate attached drives.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
ZxxZ has collected the host name and operating system product name from a compromised machine.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
build_downer has the ability to send system volume information to C2.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
cmd can be used to find information about the operating system.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
down_new has the ability to identify the system volume information of a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
dsquery has the ability to enumerate various information, such as the operating system and host name, for systems within a domain.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
macOS.OSAMiner can gather the device serial number and has checked to ensure there is enough disk space using the Unix utility `df`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
metaMain can collect the computer name from a compromised host.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
njRAT enumerates the victim operating system and computer name during the initial infection.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command `systeminfo`.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
zwShell can obtain the victim PC name and OS version.
Technique: T1082 System Information Discovery, Tactic: TA0007 Discovery
During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
During Operation Dream Job, Lazarus Group conducted word searches within documents on a compromised host in search of security and financial matters.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
APT18 can list files information for specific directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
APT3 has a tool that looks for files and directories on the local file system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
APT32's backdoor possesses the capability to list files and directories on a machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
APT38 have enumerated files and directories, or searched in specific locations within a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
APT39 has used tools with the ability to search for files on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
APT41 has executed `file /bin/pwd` on exploited victims, perhaps to return architecture related information.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
APT5 has used the BLOODMINE utility to discover files with .css, .jpg, .png, .gif, .ico, .js, and .jsp extensions in Pulse Secure Connect logs.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Aoqin Dragon has run scripts to identify file formats including Microsoft Word.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Chimera has utilized multiple commands to identify data of interest in file and directory listings.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Dark Caracal collected file listings of all default Windows directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Darkhotel has used malware that searched for files with specific patterns.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Dragonfly has used a batch script to gather folder and file names from victim hosts.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
FIN13 has used the Windows `dir` command to enumerate files and directories in a victim's network.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Fox Kitten has used WizTree to obtain network files and directory listings.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
HAFNIUM has searched file contents on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Inception used a file listing plugin to collect information about file and directories both on local and remote drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Ke3chang uses command-line interaction to search files and directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Kimsuky has the ability to enumerate all files and directories on an infected system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Sandworm Team has enumerated files on a compromised host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Sidewinder has used malware to collect information on files and directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Tropic Trooper has monitored files' modified time.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the `lPH*.dll` pattern.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Windigo has used a script to check for the presence of files created by OpenSSH backdoors.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: `dir c:\ >> %temp%\download` `dir "c:\Documents and Settings" >> %temp%\download` `dir "c:\Program Files\" >> %temp%\download` `dir d:\ >> %temp%\download`
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
4H RAT has the capability to obtain file and directory listings.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
ADVSTORESHELL can list files and directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
AcidRain identifies specific files and directories in the Linux operating system associated with storage devices.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Action RAT has the ability to collect drive and file information on an infected machine.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware. These checks are performed through native Windows functions such as `GetFileAttributesW`.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Amadey has searched for folders associated with antivirus software.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Aria-body has the ability to gather metadata from a file and to search for file and directory names.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
AuditCred can search through folders and files on the system.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Avaddon has searched for specific files prior to encryption.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Avenger has the ability to browse files in directories such as Program Files and the Desktop.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
AvosLocker has searched for files and directories on a compromised network.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BACKSPACE allows adversaries to search for files.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BADFLICK has searched for files on the infected host.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery
BBSRAT can list file and directory information.
Technique: T1083 File and Directory Discovery, Tactic: TA0007 Discovery