# T1082 - System Information Discovery
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1082)
<blockquote>An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. A breakdown of system data can also be gathered through the macOS <code>systemsetup</code> command, but it requires administrative privileges.

Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)</blockquote>

## Atomic Tests

- [Atomic Test #1 - System Information Discovery](#atomic-test-1---system-information-discovery)

- [Atomic Test #2 - System Information Discovery](#atomic-test-2---system-information-discovery)

- [Atomic Test #3 - List OS Information](#atomic-test-3---list-os-information)

- [Atomic Test #4 - Linux VM Check via Hardware](#atomic-test-4---linux-vm-check-via-hardware)

- [Atomic Test #5 - Linux VM Check via Kernel Modules](#atomic-test-5---linux-vm-check-via-kernel-modules)

- [Atomic Test #6 - Hostname Discovery (Windows)](#atomic-test-6---hostname-discovery-windows)

- [Atomic Test #7 - Hostname Discovery](#atomic-test-7---hostname-discovery)

- [Atomic Test #8 - Windows MachineGUID Discovery](#atomic-test-8---windows-machineguid-discovery)

- [Atomic Test #9 - Griffon Recon](#atomic-test-9---griffon-recon)

- [Atomic Test #10 - Environment variables discovery on windows](#atomic-test-10---environment-variables-discovery-on-windows)

- [Atomic Test #11 - Environment variables discovery on macos and linux](#atomic-test-11---environment-variables-discovery-on-macos-and-linux)


<br/>

## Atomic Test #1 - System Information Discovery
Identify System Info. Upon execution, system info and time info will be displayed.

**Supported Platforms:** Windows


**auto_generated_guid:** 66703791-c902-4560-8770-42b8a91f7667






#### Attack Commands: Run with `command_prompt`! 


```cmd
systeminfo
reg query HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum
```






<br/>
<br/>

## Atomic Test #2 - System Information Discovery
Identify System Info

**Supported Platforms:** macOS


**auto_generated_guid:** edff98ec-0f73-4f63-9890-6b117092aff6






#### Attack Commands: Run with `sh`! 


```sh
system_profiler
ls -al /Applications
```






<br/>
<br/>

## Atomic Test #3 - List OS Information
Identify System Info

**Supported Platforms:** Linux, macOS


**auto_generated_guid:** cccb070c-df86-4216-a5bc-9fb60c74e27c





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Output file used to store the results. | Path | /tmp/T1082.txt|


#### Attack Commands: Run with `sh`! 


```sh
uname -a >> #{output_file}
if [ -f /etc/lsb-release ]; then cat /etc/lsb-release >> #{output_file}; fi;
if [ -f /etc/redhat-release ]; then cat /etc/redhat-release >> #{output_file}; fi;      
if [ -f /etc/issue ]; then cat /etc/issue >> #{output_file}; fi;
uptime >> #{output_file}
cat #{output_file} 2>/dev/null
```

#### Cleanup Commands:
```sh
rm #{output_file} 2>/dev/null
```





<br/>
<br/>

## Atomic Test #4 - Linux VM Check via Hardware
Identify virtual machine hardware. This technique is used by the Pupy RAT and other malware.

**Supported Platforms:** Linux


**auto_generated_guid:** 31dad7ad-2286-4c02-ae92-274418c85fec






#### Attack Commands: Run with `bash`! 


```bash
if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi;
if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi;
if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi;
if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi;
if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi;
if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi;
if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi;
if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xen\|KVM\|Microsoft"; fi;
```






<br/>
<br/>

## Atomic Test #5 - Linux VM Check via Kernel Modules
Identify virtual machine guest kernel modules. This technique is used by the Pupy RAT and other malware.

**Supported Platforms:** Linux


**auto_generated_guid:** 8057d484-0fae-49a4-8302-4812c4f1e64e






#### Attack Commands: Run with `bash`! 


```bash
sudo lsmod | grep -i "vboxsf\|vboxguest"
sudo lsmod | grep -i "vmw_baloon\|vmxnet"
sudo lsmod | grep -i "xen-vbd\|xen-vnif"
sudo lsmod | grep -i "virtio_pci\|virtio_net"
sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc"
```






<br/>
<br/>

## Atomic Test #6 - Hostname Discovery (Windows)
Identify system hostname for Windows. Upon execution, the hostname of the device will be displayed.

**Supported Platforms:** Windows


**auto_generated_guid:** 85cfbf23-4a1e-4342-8792-007e004b975f






#### Attack Commands: Run with `command_prompt`! 


```cmd
hostname
```






<br/>
<br/>

## Atomic Test #7 - Hostname Discovery
Identify system hostname for Linux and macOS systems.

**Supported Platforms:** Linux, macOS


**auto_generated_guid:** 486e88ea-4f56-470f-9b57-3f4d73f39133






#### Attack Commands: Run with `bash`! 


```bash
hostname
```






<br/>
<br/>

## Atomic Test #8 - Windows MachineGUID Discovery
Identify the Windows MachineGUID value for a system. Upon execution, the machine GUID will be displayed from registry.

**Supported Platforms:** Windows


**auto_generated_guid:** 224b4daf-db44-404e-b6b2-f4d1f0126ef8






#### Attack Commands: Run with `command_prompt`! 


```cmd
REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
```






<br/>
<br/>

## Atomic Test #9 - Griffon Recon
This script emulates the reconnaissance script seen in used by Griffon and was modified by security researcher Kirk Sayre 
in order simply print the recon results to the screen as opposed to exfiltrating them. [Script](https://gist.github.com/kirk-sayre-work/7cb5bf4e2c7c77fa5684ddc17053f1e5).  
For more information see also [https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon](https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon) and [https://attack.mitre.org/software/S0417/](https://attack.mitre.org/software/S0417/)

**Supported Platforms:** Windows


**auto_generated_guid:** 69bd4abe-8759-49a6-8d21-0f15822d6370





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| vbscript | Path to sample script | String | PathToAtomicsFolder&#92;T1082&#92;src&#92;griffon_recon.vbs|


#### Attack Commands: Run with `powershell`! 


```powershell
cscript #{vbscript}
```






<br/>
<br/>

## Atomic Test #10 - Environment variables discovery on windows
Identify all environment variables. Upon execution, environments variables and your path info will be displayed.

**Supported Platforms:** Windows


**auto_generated_guid:** f400d1c0-1804-4ff8-b069-ef5ddd2adbf3






#### Attack Commands: Run with `command_prompt`! 


```cmd
set
```






<br/>
<br/>

## Atomic Test #11 - Environment variables discovery on macos and linux
Identify all environment variables. Upon execution, environments variables and your path info will be displayed.

**Supported Platforms:** macOS, Linux


**auto_generated_guid:** fcbdd43f-f4ad-42d5-98f3-0218097e2720






#### Attack Commands: Run with `sh`! 


```sh
env
```






<br/>
