attack_technique: T1082
display_name: System Information Discovery
atomic_tests:
- name: System Information Discovery
  auto_generated_guid: 66703791-c902-4560-8770-42b8a91f7667
  description: |
    Identify System Info. Upon execution, system info and time info will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      systeminfo
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum
    name: command_prompt
- name: System Information Discovery
  auto_generated_guid: edff98ec-0f73-4f63-9890-6b117092aff6
  description: |
    Identify System Info
  supported_platforms:
  - macos
  executor:
    command: |
      system_profiler
      ls -al /Applications
    name: sh
- name: List OS Information
  auto_generated_guid: cccb070c-df86-4216-a5bc-9fb60c74e27c
  description: |
    Identify System Info
  supported_platforms:
  - linux
  - macos
  input_arguments:
    output_file:
      description: Output file used to store the results.
      type: Path
      default: /tmp/T1082.txt
  executor:
    command: |
      uname -a >> #{output_file}
      if [ -f /etc/lsb-release ]; then cat /etc/lsb-release >> #{output_file}; fi;
      if [ -f /etc/redhat-release ]; then cat /etc/redhat-release >> #{output_file}; fi;      
      if [ -f /etc/issue ]; then cat /etc/issue >> #{output_file}; fi;
      uptime >> #{output_file}
      cat #{output_file} 2>/dev/null
    cleanup_command: |
      rm #{output_file} 2>/dev/null
    name: sh
- name: Linux VM Check via Hardware
  auto_generated_guid: 31dad7ad-2286-4c02-ae92-274418c85fec
  description: |
    Identify virtual machine hardware. This technique is used by the Pupy RAT and other malware.
  supported_platforms:
  - linux
  executor:
    command: |
      if [ -f /sys/class/dmi/id/bios_version ]; then cat /sys/class/dmi/id/bios_version | grep -i amazon; fi;
      if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/product_name | grep -i "Droplet\|HVM\|VirtualBox\|VMware"; fi;
      if [ -f /sys/class/dmi/id/product_name ]; then cat /sys/class/dmi/id/chassis_vendor | grep -i "Xen\|Bochs\|QEMU"; fi;
      if [ -x "$(command -v dmidecode)" ]; then sudo dmidecode | grep -i "microsoft\|vmware\|virtualbox\|quemu\|domu"; fi;
      if [ -f /proc/scsi/scsi ]; then cat /proc/scsi/scsi | grep -i "vmware\|vbox"; fi;
      if [ -f /proc/ide/hd0/model ]; then cat /proc/ide/hd0/model | grep -i "vmware\|vbox\|qemu\|virtual"; fi;
      if [ -x "$(command -v lspci)" ]; then sudo lspci | grep -i "vmware\|virtualbox"; fi;
      if [ -x "$(command -v lscpu)" ]; then sudo lscpu | grep -i "Xen\|KVM\|Microsoft"; fi;
    name: bash
- name: Linux VM Check via Kernel Modules
  auto_generated_guid: 8057d484-0fae-49a4-8302-4812c4f1e64e
  description: |
    Identify virtual machine guest kernel modules. This technique is used by the Pupy RAT and other malware.
  supported_platforms:
  - linux
  executor:
    command: |
      sudo lsmod | grep -i "vboxsf\|vboxguest"
      sudo lsmod | grep -i "vmw_baloon\|vmxnet"
      sudo lsmod | grep -i "xen-vbd\|xen-vnif"
      sudo lsmod | grep -i "virtio_pci\|virtio_net"
      sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc"
    name: bash
- name: Hostname Discovery (Windows)
  auto_generated_guid: 85cfbf23-4a1e-4342-8792-007e004b975f
  description: |
    Identify system hostname for Windows. Upon execution, the hostname of the device will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      hostname
    name: command_prompt
- name: Hostname Discovery
  auto_generated_guid: 486e88ea-4f56-470f-9b57-3f4d73f39133
  description: |
    Identify system hostname for Linux and macOS systems.
  supported_platforms:
  - linux
  - macos
  executor:
    command: |
      hostname
    name: bash
- name: Windows MachineGUID Discovery
  auto_generated_guid: 224b4daf-db44-404e-b6b2-f4d1f0126ef8
  description: |
    Identify the Windows MachineGUID value for a system. Upon execution, the machine GUID will be displayed from registry.
  supported_platforms:
  - windows
  executor:
    command: |
      REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    name: command_prompt
- name: Griffon Recon
  auto_generated_guid: 69bd4abe-8759-49a6-8d21-0f15822d6370
  description: |-
    This script emulates the reconnaissance script seen in used by Griffon and was modified by security researcher Kirk Sayre 
    in order simply print the recon results to the screen as opposed to exfiltrating them. [Script](https://gist.github.com/kirk-sayre-work/7cb5bf4e2c7c77fa5684ddc17053f1e5).  
    For more information see also [https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon](https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon) and [https://attack.mitre.org/software/S0417/](https://attack.mitre.org/software/S0417/)
  supported_platforms:
  - windows
  input_arguments:
    vbscript:
      description: Path to sample script
      type: String
      default: PathToAtomicsFolder\T1082\src\griffon_recon.vbs
  executor:
    command: 'cscript #{vbscript}'
    name: powershell
    elevation_required: false
- name: Environment variables discovery on windows
  auto_generated_guid: f400d1c0-1804-4ff8-b069-ef5ddd2adbf3
  description: |
    Identify all environment variables. Upon execution, environments variables and your path info will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      set
    name: command_prompt
- name: Environment variables discovery on macos and linux
  auto_generated_guid: fcbdd43f-f4ad-42d5-98f3-0218097e2720
  description: |
    Identify all environment variables. Upon execution, environments variables and your path info will be displayed.
  supported_platforms:
  - macos
  - linux
  executor:
    command: |
      env
    name: sh
