T1082Discovery
System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an…
CVEs9
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.9
Reports1
Detections
33 Sigma rules tagged T1082System Information DiscoveryT108233 general rules
- HackTool - PCHunter Executionhightest
- HackTool - winPEAS Executionhightest
- HackTool - WinPwn Executionhightest
- HackTool - WinPwn Execution - ScriptBlockhightest
- Network Reconnaissance Activityhightest
- Potential GobRAT File Discovery Via Grephightest
- Suspicious Kernel Dump Using Dtracehightest
- Bitbucket User Details Export Attempt Detectedmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to System Information Discovery
9 CVEs, by priority. Each link shows its badge.- CVE-2023-34362Progress MOVEit Transfer SQL Injection VulnerabilityProgress · MOVEit TransferKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.03%86.0priority
- CVE-2024-23692Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityRejetto · HTTP File ServerKEVRansomwarePublic exploitCritical · 9.8T1082System Information DiscoveryT1005Data from Local System+2 moreMITRE CTID mapping of the KEV entry · primary impact99.5%Top 0.06%79.8priority
- CVE-2021-40449Microsoft Windows Win32k Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1566PhishingT1059.003Windows Command Shell+6 moreMITRE CTID mapping of the KEV entry · follow-on activity81.9%Top 0.35%78.4priority
- CVE-2020-8195Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVPublic exploitMedium · 6.5T1056Input CaptureT1082System Information Discovery+1 moreMITRE CTID mapping of the KEV entry · primary impact33.0%Top 1.6%77.2priority
- CVE-2020-8196Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVPublic exploitMedium · 4.3T1056Input CaptureT1082System Information Discovery+1 moreMITRE CTID mapping of the KEV entry · primary impact26.3%Top 2%75.6priority
- CVE-2018-19322GIGABYTE Multiple Products Code Execution VulnerabilityGIGABYTE · Multiple ProductsKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1082System Information DiscoveryAI mapping from the description · primary impact1.8%Top 21%74.2priority
- CVE-2019-1653Cisco Small Business RV320 and RV325 Routers Information Disclosure VulnerabilityCisco · Small Business RV320 and RV325 RoutersKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1082System Information Discovery+2 more · 1 reportMITRE CTID mapping of the KEV entry · primary impact99.9%Top 0.04%72.1priority
- CVE-2023-43770Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityRoundcube · WebmailKEVPublic exploitMedium · 6.1T1189Drive-by CompromiseT1059Command and Scripting Interpreter+1 moreMITRE CTID mapping of the KEV entry · follow-on activity63.7%Top 0.79%67.1priority
- CVE-2023-21492Samsung Mobile Devices Insertion of Sensitive Information Into Log File VulnerabilityAI mapping from the description · primary impact2.6%Top 15%58.1priority