Log in Request a demo

Attack technique

System Information Discovery

System Information Discovery is when an attacker collects details about a device, such as its operating system version, patch level and hardware.

In short

System Information Discovery is when an attacker collects details about a device, such as its operating system version, patch level and hardware. The attacker uses this to decide what to do next on that device. It is a Discovery technique in MITRE ATT&CK.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Discovery · Step 10 Of 15 In The Attack Chain

  1. MITRE IDT1082ATT&CK technique
  2. Detection4ways to spot itData sources MITRE lists
  3. Defences1ways to stop itFocus on detection

How it works

After getting onto a device, an attacker often wants to know what it is. They look for the operating system version, installed patches, service packs and the type of hardware.

The answers help the attacker choose their next move. MITRE notes that this can inform whether to deploy a full infection and which actions to take, and it can also guide how to hide.

The technique is not limited to laptops and servers. It applies to Windows, Linux, macOS, network devices and ESXi hosts. In cloud accounts, an attacker with valid access can read instance and virtual machine details through the provider’s own interfaces.

Because the information comes from normal system features, the activity can look like routine administration.

A real example

  • MITRE ATT&CK lists Action RAT as able to collect the hostname, OS version and OS architecture of an infected host.
  • MITRE ATT&CK lists ADVSTORESHELL as able to run Systeminfo to gather information about the victim.
  • MITRE ATT&CK lists Agent Tesla as collecting the computer name and details of the processor, memory, OS and video card.
  • MITRE ATT&CK lists Akira as using the GetSystemInfo Windows function to count the processors on a victim machine.
  • MITRE ATT&CK lists Anchor as able to find the hostname and Linux version of a compromised host.

How to detect

  1. Watch for system inspection commands

    Look for scripts or terminals that run utilities which report the operating system, hardware or host name, especially on devices where staff do not normally do this.

  2. Watch processes that read system settings

    A process that inspects the environment and then reads operating system configuration or version information is worth a closer look.

  3. Watch cloud and device activity

    Review cloud API calls that list instances or virtual machines, and commands run on network devices or ESXi hosts that print version and hardware details.

  4. Data sources MITRE lists

    Command Execution, Instance Enumeration, Process Creation, Windows Registry Key Modification

How to defend

  1. Focus on detection

    MITRE says this technique cannot be easily stopped with preventive controls, because it abuses normal system features. Good logging and alerting on unusual use matter more.

Questions

What is System Information Discovery?

T1082 is when an attacker collects details about a device, such as operating system version, patch level and hardware, to decide what to do next on that device.

Which systems does it apply to?

It applies to Windows, Linux, macOS, network devices and ESXi hosts. In cloud accounts, an attacker with valid access can read instance and virtual machine details through the provider's own interfaces.

How can I detect System Information Discovery?

Look for scripts or terminals running utilities that report the operating system, hardware or host name where staff do not normally do this, and for cloud API calls that list instances.

Can it be prevented?

MITRE says it cannot be easily stopped with preventive controls because it abuses normal system features. Good logging and alerting on unusual use matter more.

In our research

  1. Volt Typhoon advisory AA24-038A: what CISA says October 2026
  2. APT38: From SWIFT Heists to Crypto Fortresses September 2025
  3. KageNoHitobito Ransomware Technical Analysis August 2024
  4. Stone Gaze: In-Depth Analysis of Medusa Ransomware July 2024
  5. [Research Summary]: RokRat June 2024
  6. Xeno RAT Technical Analysis June 2024

Sources

  1. MITRE ATT&CK T1082: System Information Discovery MITRE
  2. MITRE ATT&CK Tactic TA0007: Discovery MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more