Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Исследование системы

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get`, `system version get`, and `storage filesystem list` (to list storage volumes).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis) Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)

ID: T1082

Тактика(-и): Discovery

Платформы: ESXi, IaaS, Linux, Network Devices, Windows, macOS

Источники данных: Command: Command Execution, Process: OS API Execution, Process: Process Creation

Версия: 2.6

Дата создания: 31 May 2017

Последнее изменение: 15 Apr 2025

Название	Описание
Примеры процедур
TrickBot	TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.(Citation: S2 Grupo TrickBot June 2017)(Citation: Fidelis TrickBot Oct 2016)(Citation: Cyberreason Anchor December 2019)(Citation: Eclypsium Trickboot December 2020)
PowerDuke	PowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.(Citation: Volexity PowerDuke November 2016)
BLINDINGCAN	BLINDINGCAN has collected from a victim machine the system name, processor information, OS version, and disk information, including type and free space available.(Citation: US-CERT BLINDINGCAN Aug 2020)
Ninja	Ninja can obtain the computer name and information on the OS and physical drives from targeted hosts.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)
Pikabot	Pikabot performs a variety of system checks and gathers system information, including commands such as `whoami`.(Citation: Zscaler Pikabot 2023)(Citation: Elastic Pikabot 2024)
RCSession	RCSession can gather system information from a compromised host.(Citation: Profero APT27 December 2020)
Spark	Spark can collect the hostname, keyboard layout, and language from the system.(Citation: Unit42 Molerat Mar 2020)
SynAck	SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.(Citation: SecureList SynAck Doppelgänging May 2018)
Bumblebee	Bumblebee can enumerate the OS version and domain on a targeted system.(Citation: Google EXOTIC LILY March 2022)(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)
MURKYTOP	MURKYTOP has the capability to retrieve information about the OS.(Citation: FireEye Periscope March 2018)
GRIFFON	GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .(Citation: SecureList Griffon May 2019)
Amadey	Amadey has collected the computer name and OS version from a compromised machine.(Citation: Korean FSI TA505 2020)(Citation: BlackBerry Amadey 2020)
Covenant	Covenant implants can gather basic information on infected systems.(Citation: Github Covenant)
Proxysvc	Proxysvc collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.(Citation: McAfee GhostSecret)
Orz	Orz can gather the victim OS version and whether it is 64 or 32 bit.(Citation: Proofpoint Leviathan Oct 2017)
Torisma	Torisma can use `GetlogicalDrives` to get a bitmask of all drives available on a compromised system. It can also use `GetDriveType` to determine if a new drive is a CD-ROM drive.(Citation: McAfee Lazarus Nov 2020)
NOKKI	NOKKI can gather information on drives and the operating system on the victim’s machine.(Citation: Unit 42 NOKKI Sept 2018)
yty	yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command `systeminfo`.(Citation: ASERT Donot March 2018)
Backdoor.Oldrea	Backdoor.Oldrea collects information about the OS and computer name.(Citation: Symantec Dragonfly)(Citation: Gigamon Berserk Bear October 2021)
Stuxnet	Stuxnet collects system information including computer and domain names, OS version, and S7P paths.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
RotaJakiro	RotaJakiro executes a set of commands to collect device information, including `uname`. Another example is the `cat /etc/*release \| uniq` command used to collect the current OS distribution.(Citation: RotaJakiro 2021 netlab360 analysis)
Get2	Get2 has the ability to identify the computer name and Windows version of an infected host.(Citation: Proofpoint TA505 October 2019)
POWRUNER	POWRUNER may collect information about the system by running `hostname` and `systeminfo` on a victim.(Citation: FireEye APT34 Dec 2017)
KOPILUWAK	KOPILUWAK can discover logical drive information on compromised hosts.(Citation: Mandiant Suspected Turla Campaign February 2023)
SharpStage	SharpStage has checked the system settings to see if Arabic is the configured language.(Citation: BleepingComputer Molerats Dec 2020)
Sardonic	Sardonic has the ability to collect the computer name, CPU manufacturer name, and C:\ drive serial number from a compromised machine. Sardonic also has the ability to execute the `ver` and `systeminfo` commands.(Citation: Bitdefender Sardonic Aug 2021)
HALFBAKED	HALFBAKED can obtain information about the OS, processor, and BIOS.(Citation: FireEye FIN7 April 2017)
Misdat	The initial beacon packet for Misdat contains the operating system version of the victim.(Citation: Cylance Dust Storm)
Emissary	Emissary has the capability to execute ver and systeminfo commands.(Citation: Emissary Trojan Feb 2016)
ShimRatReporter	ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.(Citation: FOX-IT May 2016 Mofang)
KEYMARBLE	KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, disk devices, and time elapsed since system start.(Citation: US-CERT KEYMARBLE Aug 2018)
BUBBLEWRAP	BUBBLEWRAP collects system information, including the operating system version and hostname.(Citation: FireEye admin@338)
SILENTTRINITY	SILENTTRINITY can collect information related to a compromised host, including OS version and a list of drives.(Citation: GitHub SILENTTRINITY Modules July 2019)
HAWKBALL	HAWKBALL can collect the OS version, architecture information, and computer name.(Citation: FireEye HAWKBALL Jun 2019)
Ursnif	Ursnif has used Systeminfo to gather system information.(Citation: TrendMicro Ursnif Mar 2015)
ThreatNeedle	ThreatNeedle can collect system profile information from a compromised host.(Citation: Kaspersky ThreatNeedle Feb 2021)
Naid	Naid collects a unique identifier (UID) from a compromised host.(Citation: Symantec Naid June 2012)
RansomHub	RansomHub can retrieve information about virtual machines.(Citation: Group-IB RansomHub FEB 2025)
ZLib	ZLib has the ability to enumerate system information.(Citation: Cylance Dust Storm)
RedLeaves	RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Accenture Hogfish April 2018)
LITTLELAMB.WOOLTEA	LITTLELAMB.WOOLTEA can check the type of Ivanti VPN device it is running on by executing `first_run()` to identify the first four bytes of the motherboard serial number.(Citation: Mandiant Cutting Edge Part 3 February 2024)
Felismus	Felismus collects the system information, including hostname and OS version, and sends it to the C2 server.(Citation: Forcepoint Felismus Mar 2017)
Zeus Panda	Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.(Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)
CARROTBAT	CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.(Citation: Unit 42 CARROTBAT November 2018)(Citation: Unit 42 CARROTBAT January 2020)
GravityRAT	GravityRAT collects the MAC address, computer name, and CPU information.(Citation: Talos GravityRAT)
Bankshot	Bankshot gathers system information, network addresses, disk type, disk free space, and the operation system version.(Citation: McAfee Bankshot)(Citation: US-CERT Bankshot Dec 2017)
SharpDisco	SharpDisco can use a plugin to enumerate system drives.(Citation: MoustachedBouncer ESET August 2023)
StrongPity	StrongPity can identify the hard disk volume serial number on a compromised host.(Citation: Talos Promethium June 2020)
HAPPYWORK	can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.(Citation: FireEye APT37 Feb 2018)
PLAINTEE	PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.(Citation: Rancor Unit42 June 2018)
Pony	Pony has collected the Service Pack, language, and region information to send to the C2.(Citation: Malwarebytes Pony April 2016)
WinMM	WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.(Citation: Baumgartner Naikon 2015)
Nebulae	Nebulae can discover logical drive information including the drive type, free space, and volume information.(Citation: Bitdefender Naikon April 2021)
Kasidet	Kasidet has the ability to obtain a victim's system name and operating system version.(Citation: Zscaler Kasidet)
OceanSalt	OceanSalt can collect the computer name from the system.(Citation: McAfee Oceansalt Oct 2018)
Brave Prince	Brave Prince collects hard drive content and system configuration information.(Citation: McAfee Gold Dragon)
AppleSeed	AppleSeed can identify the OS version of a targeted system.(Citation: Malwarebytes Kimsuky June 2021)
macOS.OSAMiner	macOS.OSAMiner can gather the device serial number and has checked to ensure there is enough disk space using the Unix utility `df`.(Citation: SentinelLabs reversing run-only applescripts 2021)
NETWIRE	NETWIRE can discover and collect victim system information.(Citation: McAfee Netwire Mar 2015)
EnvyScout	EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.(Citation: MSTIC Nobelium Toolset May 2021)
SslMM	SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.(Citation: Baumgartner Naikon 2015)
IMAPLoader	IMAPLoader uses WMI queries to gather information about the victim machine.(Citation: PWC Yellow Liderc 2023)
Gomir	Gomir collects information on infected systems such as hostname, username, CPU, and RAM information.(Citation: Symantec Troll Stealer 2024)
Aria-body	Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host.(Citation: CheckPoint Naikon May 2020)
BOLDMOVE	BOLDMOVE performs system survey actions following initial execution.(Citation: Google Cloud BOLDMOVE 2023)
Crimson	Crimson contains a command to collect the victim PC name, disk drive information, and operating system.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
DUSTTRAP	DUSTTRAP reads the value of the infected system's `HKLM\SYSTEM\Microsoft\Cryptography\MachineGUID` value.(Citation: Google Cloud APT41 2024)
Empire	Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.(Citation: Github PowerShell Empire)(Citation: Talos Frankenstein June 2019)
Turian	Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.(Citation: ESET BackdoorDiplomacy Jun 2021)
BADHATCH	BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, drive information, OS type/version, bitness, and hostname.(Citation: Gigamon BADHATCH Jul 2019)(Citation: BitDefender BADHATCH Mar 2021)
Machete	Machete collects the hostname of the target computer.(Citation: ESET Machete July 2019)
Action RAT	Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.(Citation: MalwareBytes SideCopy Dec 2021)
Avenger	Avenger has the ability to identify the host volume ID and the OS architecture on a compromised host.(Citation: Trend Micro Tick November 2019)
Prikormka	A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.(Citation: ESET Operation Groundbait)
dsquery	dsquery has the ability to enumerate various information, such as the operating system and host name, for systems within a domain.(Citation: Mandiant APT41)
Gootloader	Gootloader can inspect the User-Agent string in GET request header information to determine the operating system of targeted systems.(Citation: Sophos Gootloader)
PingPull	PingPull can retrieve the hostname of a compromised host.(Citation: Unit 42 PingPull Jun 2022)
WellMess	WellMess can identify the computer name of a compromised host.(Citation: PWC WellMess July 2020)(Citation: CISA WellMess July 2020)
DropBook	DropBook has checked for the presence of Arabic language in the infected machine's settings.(Citation: Cybereason Molerats Dec 2020)
Woody RAT	Woody RAT can retrieve the following information from an infected machine: OS, architecture, computer name, OS build version, environment variables, and storage drives.(Citation: MalwareBytes WoodyRAT Aug 2022)
Mafalda	Mafalda can collect the computer name and enumerate all drives on a compromised host.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
KARAE	KARAE can collect system information.(Citation: FireEye APT37 Feb 2018)
Squirrelwaffle	Squirrelwaffle has gathered victim computer information and configurations.(Citation: ZScaler Squirrelwaffle Sep 2021)
AuTo Stealer	AuTo Stealer has the ability to collect the hostname and OS information from an infected host.(Citation: MalwareBytes SideCopy Dec 2021)
ShrinkLocker	ShrinkLocker uses WMI queries to gather various information about the victim machine and operating system.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)
Hildegard	Hildegard has collected the host's OS, CPU, and memory information.(Citation: Unit 42 Hildegard Malware)
SLOWDRIFT	SLOWDRIFT collects and sends system information to its C2.(Citation: FireEye APT37 Feb 2018)
SHUTTERSPEED	SHUTTERSPEED can collect system information.(Citation: FireEye APT37 Feb 2018)
SombRAT	SombRAT can execute `getinfo` to enumerate the computer name and OS version of a compromised system.(Citation: BlackBerry CostaRicto November 2020)
FlawedAmmyy	FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.(Citation: Proofpoint TA505 Mar 2018)
Snip3	Snip3 has the ability to query `Win32_ComputerSystem` for system information. (Citation: Morphisec Snip3 May 2021)
Rifdoor	Rifdoor has the ability to identify the Windows version on the compromised host.(Citation: Carbon Black HotCroissant April 2020)
HOPLIGHT	HOPLIGHT has been observed collecting victim machine information like OS version, volume information, and more.(Citation: US-CERT HOPLIGHT Apr 2019)
Cuckoo Stealer	Cuckoo Stealer can gather information about the OS version and hardware on compromised hosts.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024)
MobileOrder	MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.(Citation: Scarlet Mimic Jan 2016)
InvisiMole	InvisiMole can gather information on the mapped drives, OS version, computer name, DEP policy, memory size, and system volume serial number.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Volgmer	Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.(Citation: US-CERT Volgmer Nov 2017)(Citation: US-CERT Volgmer 2 Nov 2017)(Citation: Symantec Volgmer Aug 2014)
WINERACK	WINERACK can gather information about the host.(Citation: FireEye APT37 Feb 2018)
WhisperGate	WhisperGate has the ability to enumerate fixed logical drives on a targeted system.(Citation: Cisco Ukraine Wipers January 2022)
ZeroT	ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.(Citation: Proofpoint ZeroT Feb 2017)
AcidPour	AcidPour can identify various system locations and mapped devices on Linux systems as a precursor to wiping activity.(Citation: SentinelOne AcidPour 2024)
PoshC2	PoshC2 contains modules, such as `Get-ComputerInfo`, for enumerating common system information.(Citation: GitHub PoshC2)
Skidmap	Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.(Citation: Trend Micro Skidmap)
Okrum	Okrum can collect computer name, locale information, and information about the OS and architecture.(Citation: ESET Okrum July 2019)
Bonadan	Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.(Citation: ESET ForSSHe December 2018)
Line Dancer	Line Dancer can gather system configuration information by running the native `show configuration` command.(Citation: Cisco ArcaneDoor 2024)
Neoichor	Neoichor can collect the OS version and computer name from a compromised host.(Citation: Microsoft NICKEL December 2021)
Raspberry Robin	Raspberry Robin performs several system checks as part of anti-analysis mechanisms, including querying the operating system build number, processor vendor and type, video controller, and CPU temperature.(Citation: HP RaspberryRobin 2024)
Mispadu	Mispadu collects the OS version, computer name, and language ID.(Citation: ESET Security Mispadu Facebook Ads 2019)
Diavol	Diavol can collect the computer name and OS version from the system.(Citation: Fortinet Diavol July 2021)
BlackCat	BlackCat can obtain the computer name and UUID, and enumerate local drives.(Citation: Microsoft BlackCat Jun 2022)
Fysbis	Fysbis has used the command `ls /etc \| egrep -e"fedora\\|debian\\|gentoo\\|mandriva\\|mandrake\\|meego\\|redhat\\|lsb-\\|sun-\\|SUSE\\|release"` to determine which Linux OS version is running.(Citation: Fysbis Palo Alto Analysis)
IcedID	IcedID has the ability to identify the computer name and OS version on a compromised host.(Citation: IBM IcedID November 2017)(Citation: DFIR_Quantum_Ransomware)
VERMIN	VERMIN collects the OS name, machine name, and architecture information.(Citation: Unit 42 VERMIN Jan 2018)
Nightdoor	Nightdoor gathers information on the victim system such as CPU and Computer name as well as device drivers. Nightdoor can also collect information about disk drives, their total and free space, and file system type.(Citation: ESET EvasivePanda 2024)
MarkiRAT	MarkiRAT can obtain the computer name from a compromised host.(Citation: Kaspersky Ferocious Kitten Jun 2021)
PowerShower	PowerShower has collected system information on the infected host.(Citation: Unit 42 Inception November 2018)
Kazuar	Kazuar gathers information on the system and local drives.(Citation: Unit 42 Kazuar May 2017)
NavRAT	NavRAT uses `systeminfo` on a victim’s machine.(Citation: Talos NavRAT May 2018)
DarkComet	DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)
POORAIM	POORAIM can identify system information, including battery status.(Citation: FireEye APT37 Feb 2018)
FatDuke	FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.(Citation: ESET Dukes October 2019)
Lucifer	Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.(Citation: Unit 42 Lucifer June 2020)
BlackEnergy	BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.(Citation: F-Secure BlackEnergy 2014)(Citation: Securelist BlackEnergy Nov 2014)
zwShell	zwShell can obtain the victim PC name and OS version.(Citation: McAfee Night Dragon)
Rising Sun	Rising Sun can detect the computer name, operating system, and drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume.(Citation: McAfee Sharpshooter December 2018)
Chrommme	Chrommme has the ability to list drives and obtain the computer name of a compromised host.(Citation: ESET Gelsemium June 2021)
BADFLICK	BADFLICK has captured victim computer name, memory space, and CPU details.(Citation: Accenture MUDCARP March 2019)
ObliqueRAT	ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.(Citation: Talos Oblique RAT March 2021)
SocGholish	SocGholish has the ability to enumerate system information including the victim computer name.(Citation: SocGholish-update)(Citation: Red Canary SocGholish March 2024)(Citation: Secureworks Gold Prelude Profile)
SpicyOmelette	SpicyOmelette can identify the system name of a compromised host.(Citation: Secureworks GOLD KINGSWOOD September 2018)
XAgentOSX	XAgentOSX contains the getInstalledAPP function to run `ls -la /Applications` to gather what applications are installed.(Citation: XAgentOSX 2017)
Green Lambert	Green Lambert can use `uname` to identify the operating system name, version, and processor type.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
LightSpy	LightSpy's second stage implant uses the `DeviceInformation` class to collect system information, including CPU usage, battery statistics, memory allocations, screen size, etc.(Citation: Huntress LightSpy macOS 2024)
PUNCHBUGGY	PUNCHBUGGY can gather system information such as computer names.(Citation: Morphisec ShellTea June 2019)
HELLOKITTY	HELLOKITTY can enumerate logical drives on a target system.(Citation: FireEye FiveHands April 2021)
KeyBoy	KeyBoy can gather extended system information, such as information about the operating system, disks, and memory.(Citation: PWC KeyBoys Feb 2017)(Citation: Rapid7 KeyBoy Jun 2013)
MiniDuke	MiniDuke can gather the hostname on a compromised machine.(Citation: ESET Dukes October 2019)
Anchor	Anchor can determine the hostname and linux version on a compromised host.(Citation: Medium Anchor DNS July 2020)
DarkTortilla	DarkTortilla can obtain system information by querying the `Win32_ComputerSystem`, `Win32_BIOS`, `Win32_MotherboardDevice`, `Win32_PnPEntity`, and `Win32_DiskDrive` WMI objects.(Citation: Secureworks DarkTortilla Aug 2022)
ROKRAT	ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.(Citation: Talos ROKRAT)(Citation: Talos ROKRAT 2)(Citation: Securelist ScarCruft May 2019)(Citation: NCCGroup RokRat Nov 2018)(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021)
CORESHELL	CORESHELL collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.(Citation: FireEye APT28)
RunningRAT	RunningRAT gathers the OS version, logical drives information, processor information, and volume information.(Citation: McAfee Gold Dragon)
Babuk	Babuk can enumerate disk volumes, get disk information, and query service status.(Citation: McAfee Babuk February 2021)
DarkWatchman	DarkWatchman can collect the OS version, system architecture, and computer name.(Citation: Prevailion DarkWatchman 2021)
Dyre	Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.(Citation: Malwarebytes Dyreza November 2015)
BlackMould	BlackMould can enumerate local drives on a compromised host.(Citation: Microsoft GALLIUM December 2019)
Reaver	Reaver collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.(Citation: Palo Alto Reaver Nov 2017)
Bisonal	Bisonal has used commands and API calls to gather system information.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
S-Type	The initial beacon packet for S-Type contains the operating system version and file system of the victim.(Citation: Cylance Dust Storm)
Lumma Stealer	Lumma Stealer has gathered various system information from victim machines.(Citation: Cybereason LumaStealer Undated)(Citation: Fortinet LummaStealer 2024)(Citation: TrendMicro LummaStealer 2025)
DustySky	DustySky extracts basic information about the operating system.(Citation: DustySky)
Remsec	Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.(Citation: Kaspersky ProjectSauron Technical Analysis)
Explosive	Explosive has collected the computer name from the infected host.(Citation: CheckPoint Volatile Cedar March 2015)
AsyncRAT	AsyncRAT can check the disk size through the values obtained with `DeviceInfo.`(Citation: Telefonica Snip3 December 2021)
Epic	Epic collects the OS version, hardware information, computer name, available system memory status, disk space information, and system and user language settings.(Citation: Kaspersky Turla Aug 2014)
LightNeuron	LightNeuron gathers the victim computer name using the Win32 API call `GetComputerName`.(Citation: ESET LightNeuron May 2019)
Cuba	Cuba can enumerate local drives, disk type, and disk free space.(Citation: McAfee Cuba April 2021)
DEATHRANSOM	DEATHRANSOM can enumerate logical drives on a target system.(Citation: FireEye FiveHands April 2021)
Clambling	Clambling can discover the hostname, computer name, and Windows version of a targeted machine.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)
Agent Tesla	Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.(Citation: Fortinet Agent Tesla April 2018)(Citation: Fortinet Agent Tesla June 2017)(Citation: Malwarebytes Agent Tesla April 2020)
Akira	Akira uses the `GetSystemInfo` Windows function to determine the number of processors on a victim machine.(Citation: Kersten Akira 2023)
DarkGate	DarkGate uses the Delphi methods `Sysutils::DiskSize` and `GlobalMemoryStatusEx` to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment.(Citation: Ensilo Darkgate 2018) DarkGate will gather various system information such as domain, display adapter description, operating system type and version, processor type, and RAM amount.(Citation: Ensilo Darkgate 2018)(Citation: Rapid7 BlackBasta 2024)
Mongall	Mongall can identify drives on compromised hosts and retrieve the hostname via `gethostbyname`.(Citation: SentinelOne Aoqin Dragon June 2022)
NanHaiShu	NanHaiShu can gather the victim computer name and serial number.(Citation: Proofpoint Leviathan Oct 2017)
LockBit 3.0	LockBit 3.0 can enumerate system hostname, domain, and local drive configuration.(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)
SVCReady	SVCReady has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use of `systeminfo.exe`.(Citation: HP SVCReady Jun 2022)
Hydraq	Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.(Citation: Symantec Hydraq Jan 2010)
SHARPSTATS	SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)
Ferocious	Ferocious can use `GET.WORKSPACE` in Microsoft Excel to determine the OS version of the compromised host.(Citation: Kaspersky WIRTE November 2021)
Caterpillar WebShell	Caterpillar WebShell has a module to gather information from the compromised asset, including the computer version, computer name, IIS version, and more.(Citation: ClearSky Lebanese Cedar Jan 2021)
Netwalker	Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.(Citation: TrendMicro Netwalker May 2020)
Elise	Elise executes `systeminfo` after initial communication is made to the remote server.(Citation: Lotus Blossom Jun 2015)
Latrodectus	Latrodectus can gather operating system information.(Citation: Latrodectus APR 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)
Saint Bot	Saint Bot can identify the OS version, CPU, and other details from a victim's machine.(Citation: Malwarebytes Saint Bot April 2021)
Pay2Key	Pay2Key has the ability to gather the hostname of the victim machine.(Citation: Check Point Pay2Key November 2020)
Chaes	Chaes has collected system information, including the machine name and OS version.(Citation: Cybereason Chaes Nov 2020)
CharmPower	CharmPower can enumerate the OS version and computer name on a targeted system.(Citation: Check Point APT35 CharmPower January 2022)
TYPEFRAME	TYPEFRAME can gather the disk volume information.(Citation: US-CERT TYPEFRAME June 2018)
Bundlore	Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using `/usr/bin/sw_vers -productVersion`.(Citation: MacKeeper Bundlore Apr 2019)(Citation: 20 macOS Common Tools and Techniques)
EVILNUM	EVILNUM can obtain the computer name from the victim's system.(Citation: Prevailion EvilNum May 2020)
KOMPROGO	KOMPROGO is capable of retrieving information about the infected system.(Citation: FireEye APT32 May 2017)
SMOKEDHAM	SMOKEDHAM has used the `systeminfo` command on a compromised host.(Citation: FireEye SMOKEDHAM June 2021)
Sagerunex	Sagerunex gathers information from the infected system such as hostname.(Citation: Cisco LotusBlossom 2025)
TAINTEDSCRIBE	TAINTEDSCRIBE can use `DriveList` to retrieve drive information.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
Sys10	Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.(Citation: Baumgartner Naikon 2015)
Systeminfo	Systeminfo can be used to gather information about the operating system.(Citation: TechNet Systeminfo)
Royal	Royal can use `GetNativeSystemInfo` and `GetLogicalDrives` to enumerate system processors and logical drives.(Citation: Cybereason Royal December 2022)(Citation: Trend Micro Royal Linux ESXi February 2023)
Uroburos	Uroburos has the ability to gather basic system information and run the POSIX API `gethostbyname`.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
Metamorfo	Metamorfo has collected the hostname and operating system version from the compromised host.(Citation: FireEye Metamorfo Apr 2018)(Citation: Fortinet Metamorfo Feb 2020)(Citation: ESET Casbaneiro Oct 2019)
Trojan.Karagany	Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.(Citation: Secureworks Karagany July 2019)
Bandook	Bandook can collect information about the drives available on the system.(Citation: CheckPoint Bandook Nov 2020)
PipeMon	PipeMon can collect and send OS version and computer name as a part of its C2 beacon.(Citation: ESET PipeMon May 2020)
MagicRAT	MagicRAT collects basic system information from victim machines.(Citation: Cisco MagicRAT 2022)
KONNI	KONNI can gather the OS version, architecture information, connected drives, hostname, RAM size, and disk space information from the victim’s machine and has used `cmd /c systeminfo` command to get a snapshot of the current system state of the target machine.(Citation: Talos Konni May 2017)(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)
T9000	T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.(Citation: Palo Alto T9000 Feb 2016)
gh0st RAT	gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.(Citation: Gh0stRAT ATT March 2019)
Shamoon	Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)
MoleNet	MoleNet can collect information about the about the system.(Citation: Cybereason Molerats Dec 2020)
JHUHUGIT	JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key `HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum`. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018)
BLUELIGHT	BLUELIGHT has collected the computer name and OS version from victim machines.(Citation: Volexity InkySquid BLUELIGHT August 2021)
KGH_SPY	KGH_SPY can collect drive information from a compromised host.(Citation: Cybereason Kimsuky November 2020)
down_new	down_new has the ability to identify the system volume information of a compromised host.(Citation: Trend Micro Tick November 2019)
Ixeshe	Ixeshe collects the computer name of the victim's system during the initial infection.(Citation: Trend Micro IXESHE 2012)
Micropsia	Micropsia gathers the hostname and OS version from the victim’s machine.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)
Kerrdown	Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.(Citation: Unit 42 KerrDown February 2019)
Black Basta	Black Basta can enumerate volumes and collect system boot configuration and CPU information.(Citation: Minerva Labs Black Basta May 2022)(Citation: Cyble Black Basta May 2022)
ZeroCleare	ZeroCleare can use the `IOCTL_DISK_GET_DRIVE_GEOMETRY_EX`, `IOCTL_DISK_GET_DRIVE_GEOMETRY`, and `IOCTL_DISK_GET_LENGTH_INFO` system calls to compute disk size.(Citation: Mandiant ROADSWEEP August 2022)
StoneDrill	StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.(Citation: Kaspersky StoneDrill 2017)
OopsIE	OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.(Citation: Unit 42 OilRig Sept 2018)
4H RAT	4H RAT sends an OS version identifier in its beacons.(Citation: CrowdStrike Putter Panda)
RogueRobin	RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.(Citation: Unit 42 DarkHydrus July 2018)
Attor	Attor monitors the free disk space on the system.(Citation: ESET Attor Oct 2019)
LitePower	LitePower has the ability to list local drives and enumerate the OS architecture.(Citation: Kaspersky WIRTE November 2021)
StreamEx	StreamEx has the ability to enumerate system information.(Citation: Cylance Shell Crew Feb 2017)
SDBbot	SDBbot has the ability to identify the OS version, OS bit information and computer name.(Citation: Proofpoint TA505 October 2019)(Citation: Korean FSI TA505 2020)
RTM	RTM can obtain the computer name, OS version, and default language identifier.(Citation: ESET RTM Feb 2017)
Derusbi	Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.(Citation: Fidelis Turbo)
BlackByte Ransomware	BlackByte Ransomware gathers victim system information to generate a unique victim identifier.(Citation: Trustwave BlackByte 2021)
SodaMaster	SodaMaster can enumerate the host name and OS version on a target system.(Citation: Securelist APT10 March 2021)
StrelaStealer	StrelaStealer variants collect victim system information for exfiltration.(Citation: IBM StrelaStealer 2024)
Grandoreiro	Grandoreiro can collect the computer name and OS version from a compromised host.(Citation: ESET Grandoreiro April 2020)
LiteDuke	LiteDuke can enumerate the CPUID and BIOS version on a compromised system.(Citation: ESET Dukes October 2019)
ZxxZ	ZxxZ has collected the host name and operating system product name from a compromised machine.(Citation: Cisco Talos Bitter Bangladesh May 2022)
WINDSHIELD	WINDSHIELD can gather the victim computer name.(Citation: FireEye APT32 May 2017)
Shark	Shark can collect the GUID of a targeted machine.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
Bazar	Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)
Kobalos	Kobalos can record the hostname and kernel version of the target machine.(Citation: ESET Kobalos Jan 2021)
BadPatch	BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.(Citation: Unit 42 BadPatch Oct 2017)
RATANKBA	RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)
XLoader	XLoader can collect system information and supported language information from the victim machine.(Citation: Acronis XLoader 2021)
SOUNDBITE	SOUNDBITE is capable of gathering system information.(Citation: FireEye APT32 May 2017)
BADCALL	BADCALL collects the computer name and host name on the compromised system.(Citation: US-CERT BADCALL)
MoonWind	MoonWind can obtain the victim hostname, Windows version, RAM amount, number of drives, and screen resolution.(Citation: Palo Alto MoonWind March 2017)
Ryuk	Ryuk has called `GetLogicalDrives` to emumerate all mounted drives, and `GetDriveTypeW` to determine the drive type.(Citation: CrowdStrike Ryuk January 2019)
HermeticWiper	HermeticWiper can determine the OS version, bitness, and enumerate physical drives on a targeted host.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wizard March 2022)(Citation: Qualys Hermetic Wiper March 2022)
Final1stspy	Final1stspy obtains victim Microsoft Windows version information and CPU architecture.(Citation: Unit 42 Nokki Oct 2018)
Kapeka	Kapeka utilizes WinAPI calls and registry queries to gather system information.(Citation: WithSecure Kapeka 2024)
LockBit 2.0	LockBit 2.0 can enumerate system information including hostname, domain information, and local drive configuration.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Palo Alto Lockbit 2.0 JUN 2022)
Zebrocy	Zebrocy collects the OS version, computer name and serial number for the storage volume C:\. Zebrocy also runs the `systeminfo` command to gather system information. (Citation: Palo Alto Sofacy 06-2018)(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020)
FinFisher	FinFisher checks if the victim OS is 32 or 64-bit.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
SpeakUp	SpeakUp uses the `cat /proc/cpuinfo \| grep -c “cpu family” 2>&1` command to gather system information. (Citation: CheckPoint SpeakUp Feb 2019)
LunarMail	LunarMail can capture environmental variables on compromised hosts.(Citation: ESET Turla Lunar toolset May 2024)
Cadelspy	Cadelspy has the ability to discover information about the compromised host.(Citation: Symantec Chafer Dec 2015)
SampleCheck5000	SampleCheck5000 can create unique victim identifiers by using the compromised system’s volume ID or computer name.(Citation: ESET OilRig Downloaders DEC 2023)
SUNBURST	SUNBURST collected hostname and OS version.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)
Wingbird	Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.(Citation: Microsoft SIR Vol 21)
HotCroissant	HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.(Citation: US-CERT HOTCROISSANT February 2020)
ServHelper	ServHelper will attempt to enumerate Windows version and system architecture.(Citation: Proofpoint TA505 Jan 2019)
Unknown Logger	Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.(Citation: Forcepoint Monsoon)
REvil	REvil can identify the username, machine name, system language, keyboard layout, OS version, and system drive information on a compromised host.(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)(Citation: Secureworks REvil September 2019)
Valak	Valak can determine the Windows version and computer name on a compromised host.(Citation: Cybereason Valak May 2020)(Citation: SentinelOne Valak June 2020)
PinchDuke	PinchDuke gathers system configuration information.(Citation: F-Secure The Dukes)
Milan	Milan can enumerate the targeted machine's name and GUID.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the `ioreg` command to gather some of this information.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)(Citation: 20 macOS Common Tools and Techniques)
OilBooster	OilBooster can identify the compromised system's hostname which is used to create a unique identifier.(Citation: ESET OilRig Downloaders DEC 2023)
CaddyWiper	CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.(Citation: Cisco CaddyWiper March 2022)(Citation: Malwarebytes IssacWiper CaddyWiper March 2022 )
Cyclops Blink	Cyclops Blink has the ability to query device information.(Citation: NCSC Cyclops Blink February 2022)
TajMahal	TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.(Citation: Kaspersky TajMahal April 2019)
Pasam	Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.(Citation: Symantec Pasam May 2012)
Raccoon Stealer	Raccoon Stealer gathers information on infected systems such as operating system, processor information, RAM, and display information.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon2 2022)
Cardinal RAT	Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.(Citation: PaloAlto CardinalRat Apr 2017)
BISCUIT	BISCUIT has a command to collect the processor type, operation system, computer name, and whether the system is a laptop or PC.(Citation: Mandiant APT1)
Solar	Solar can send basic information about the infected host to C2.(Citation: ESET OilRig Campaigns Sep 2023)
Pisloader	Pisloader has a command to collect victim system information, including the system name and OS version.(Citation: Palo Alto DNS Requests)
GoldenSpy	GoldenSpy has gathered operating system information.(Citation: Trustwave GoldenSpy June 2020)
Gold Dragon	Gold Dragon collects endpoint information using the `systeminfo` command.(Citation: McAfee Gold Dragon)
Ramsay	Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
cmd	cmd can be used to find information about the operating system.(Citation: TechNet Dir)
Carberp	Carberp has collected the operating system version from the infected system.(Citation: Prevx Carberp March 2011)
NKAbuse	NKAbuse conducts multiple system checks and includes these in subsequent "heartbeat" messages to the malware's command and control server.(Citation: NKAbuse SL)
Revenge RAT	Revenge RAT collects the CPU information, OS information, and system language.(Citation: Cylance Shaheen Nov 2018)
MacMa	MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, macOS version, and disk sizes.(Citation: ESET DazzleSpy Jan 2022)
FunnyDream	FunnyDream can enumerate all logical drives on a targeted machine.(Citation: Bitdefender FunnyDream Campaign November 2020)
ROADSWEEP	ROADSWEEP can enumerate logical drives on targeted devices.(Citation: Mandiant ROADSWEEP August 2022)(Citation: Microsoft Albanian Government Attacks September 2022)
More_eggs	More_eggs has the capability to gather the OS version and computer name.(Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)
SysUpdate	SysUpdate can collect a system's architecture, operating system version, hostname, and drive information.(Citation: Trend Micro Iron Tiger April 2021)(Citation: Lunghi Iron Tiger Linux)
BackConfig	BackConfig has the ability to gather the victim's computer name.(Citation: Unit 42 BackConfig May 2020)
Kwampirs	Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands `systeminfo`, `net config workstation`, `hostname`, `ver`, `set`, and `date /t`.(Citation: Symantec Orangeworm April 2018)
BoomBox	BoomBox can enumerate the hostname, domain, and IP of a compromised host.(Citation: MSTIC Nobelium Toolset May 2021)
DEADEYE	DEADEYE can enumerate a victim computer's volume serial number and host name.(Citation: Mandiant APT41)
CrackMapExec	CrackMapExec can enumerate the system drives and associated system name.(Citation: CME Github September 2018)
Mango	Mango can collect the machine name of a compromised system which is later used as part of a unique victim identifier.(Citation: ESET OilRig Campaigns Sep 2023)
Koadic	Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.(Citation: MalwareBytes LazyScripter Feb 2021)
InnaputRAT	InnaputRAT gathers volume drive information and system information.(Citation: ASERT InnaputRAT April 2018)
Kessel	Kessel has collected the system architecture, OS version, and MAC address information.(Citation: ESET ForSSHe December 2018)
GrimAgent	GrimAgent can collect the OS, and build version on a compromised host.(Citation: Group IB GrimAgent July 2021)
YAHOYAH	YAHOYAH checks for the system’s Windows OS version and hostname.(Citation: TrendMicro TropicTrooper 2015)
Pupy	Pupy can grab a system’s information including the OS version, architecture, etc.(Citation: GitHub Pupy)
Lokibot	Lokibot has the ability to discover the computer name and Windows product name/version.(Citation: FSecure Lokibot November 2019)
Egregor	Egregor can perform a language check of the infected system and can query the CPU information (cupid).(Citation: JoeSecurity Egregor 2020)(Citation: NHS Digital Egregor Nov 2020)
PoetRAT	PoetRAT has the ability to gather information about the compromised host.(Citation: Talos PoetRAT April 2020)
StealBit	StealBit can enumerate the computer name and domain membership of the compromised system.(Citation: Cybereason StealBit Exfiltration Tool)
FELIXROOT	FELIXROOT collects the victim’s computer name, processor architecture, OS version, volume serial number, and system type.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)
ZxShell	ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.(Citation: Talos ZxShell Oct 2014)
NDiskMonitor	NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.(Citation: TrendMicro Patchwork Dec 2017)
Penquin	Penquin can report the file system type and disk space of a compromised host to C2.(Citation: Leonardo Turla Penquin May 2020)
BabyShark	BabyShark has executed the `ver` command.(Citation: Unit42 BabyShark Feb 2019)
Cannon	Cannon can gather system information from the victim’s machine such as the OS version, machine name, and drive information.(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)
build_downer	build_downer has the ability to send system volume information to C2.(Citation: Trend Micro Tick November 2019)
Winnti for Windows	Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.(Citation: Novetta Winnti April 2015)
Troll Stealer	Troll Stealer can collect local system information.(Citation: S2W Troll Stealer 2024)(Citation: Symantec Troll Stealer 2024)
Meteor	Meteor has the ability to discover the hostname of a compromised host.(Citation: Check Point Meteor Aug 2021)
njRAT	njRAT enumerates the victim operating system and computer name during the initial infection.(Citation: Fidelis njRAT June 2013)
Maze	Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.(Citation: McAfee Maze March 2020)
QuasarRAT	QuasarRAT can gather system information from the victim’s machine including the OS type.(Citation: GitHub QuasarRAT)
TURNEDUP	TURNEDUP is capable of gathering system information.(Citation: FireEye APT33 Sept 2017)
ChChes	ChChes collects the victim hostname, window resolution, and Microsoft Windows version.(Citation: Palo Alto menuPass Feb 2017)(Citation: PWC Cloud Hopper Technical Annex April 2017)
POWERSTATS	POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.(Citation: FireEye MuddyWater Mar 2018)(Citation: TrendMicro POWERSTATS V3 June 2019)
Manjusaka	Manjusaka performs basic system profiling actions to fingerprint and register the victim system with the C2 controller.(Citation: Talos Manjusaka 2022)
IceApple	The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.(Citation: CrowdStrike IceApple May 2022)
JPIN	JPIN can obtain system information such as OS version and disk space.(Citation: Microsoft PLATINUM April 2016)
metaMain	metaMain can collect the computer name from a compromised host.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
SideTwist	SideTwist can collect the computer name of a targeted system.(Citation: Check Point APT34 April 2021)
KOCTOPUS	KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.(Citation: MalwareBytes LazyScripter Feb 2021)
Heyoka Backdoor	Heyoka Backdoor can enumerate drives on a compromised host.(Citation: SentinelOne Aoqin Dragon June 2022)
Mis-Type	The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.(Citation: Cylance Dust Storm)
LunarWeb	LunarWeb can use WMI queries and shell commands such as systeminfo.exe to collect the operating system, BIOS version, and domain name of the targeted system.(Citation: ESET Turla Lunar toolset May 2024)
XCSSET	XCSSET identifies the macOS version and uses `ioreg` to determine serial number.(Citation: trendmicro xcsset xcode project 2020)
Octopus	Octopus can collect system drive information, the computer name, the size of the disk, OS version, and OS architecture information.(Citation: Securelist Octopus Oct 2018)
KillDisk	KillDisk retrieves the hard disk name by calling the `CreateFileA to \\.\PHYSICALDRIVE0` API.(Citation: Trend Micro KillDisk 1)
AppleJeus	AppleJeus has collected the victim host information after infection.(Citation: CISA AppleJeus Feb 2021)
SoreFang	SoreFang can collect the hostname, operating system configuration, product ID, and disk space on victim machines by executing Systeminfo.(Citation: CISA SoreFang July 2016)
STARWHALE	STARWHALE can gather the computer name of an infected host.(Citation: Mandiant UNC3313 Feb 2022)(Citation: DHS CISA AA22-055A MuddyWater February 2022)
MirageFox	MirageFox can collect CPU and architecture information from the victim’s machine.(Citation: APT15 Intezer June 2018)
Industroyer	Industroyer collects the victim machine’s Windows GUID.(Citation: Dragos Crashoverride 2017)
DownPaper	DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.(Citation: ClearSky Charming Kitten Dec 2017)
CozyCar	A system info module in CozyCar gathers information on the victim host’s configuration.(Citation: F-Secure CozyDuke)
Kevin	Kevin can enumerate the OS version and hostname of a targeted machine.(Citation: Kaspersky Lyceum October 2021)
Linfo	Linfo creates a backdoor through which remote attackers can retrieve system information.(Citation: Symantec Linfo May 2012)
ShadowPad	ShadowPad has discovered system information including memory status, CPU frequency, OS versions, and volume serial numbers.(Citation: Kaspersky ShadowPad Aug 2017)
Astaroth	Astaroth collects the machine name and keyboard language from the system. (Citation: Cofense Astaroth Sept 2018)(Citation: Cybereason Astaroth Feb 2019)
QakBot	QakBot can collect system information including the OS version and domain on a compromised host.(Citation: Crowdstrike Qakbot October 2020)(Citation: ATT QakBot April 2021)(Citation: Group IB Ransomware September 2020)(Citation: Microsoft Ransomware as a Service)
SYSCON	SYSCON has the ability to use Systeminfo to identify system information.(Citation: Unit 42 CARROTBAT January 2020)
Gelsemium	Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.(Citation: ESET Gelsemium June 2021)
jRAT	jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.(Citation: Symantec Frutas Feb 2013)
Dridex	Dridex has collected the computer name and OS architecture information from the system.(Citation: Checkpoint Dridex Jan 2021)
OSX/Shlayer	OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command `sw_vers -productVersion`.(Citation: Carbon Black Shlayer Feb 2019)(Citation: sentinelone shlayer to zshlayer)
Denis	Denis collects OS information and the computer name from the victim’s machine.(Citation: Securelist Denis April 2017)(Citation: Cybereason Cobalt Kitty 2017)
INC Ransomware	INC Ransomware can discover and mount hidden drives to encrypt them.(Citation: Cybereason INC Ransomware November 2023)
Comnie	Comnie collects the hostname of the victim machine.(Citation: Palo Alto Comnie)
OSInfo	OSInfo discovers information about the infected machine.(Citation: Symantec Buckeye)
Lizar	Lizar can collect the computer name from the machine,.(Citation: BiZone Lizar May 2021)
Dtrack	Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)
LoudMiner	LoudMiner has monitored CPU usage.(Citation: ESET LoudMiner June 2019)
Azorult	Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
BACKSPACE	During its initial execution, BACKSPACE extracts operating system information from the infected host.(Citation: FireEye APT30)
Zox	Zox can enumerate attached drives.(Citation: Novetta-Axiom)
UPPERCUT	UPPERCUT has the capability to gather the system’s hostname and OS version.(Citation: FireEye APT10 Sept 2018)
ADVSTORESHELL	ADVSTORESHELL can run Systeminfo to gather information about the victim.(Citation: ESET Sednit Part 2)(Citation: Bitdefender APT28 Dec 2015)
StrifeWater	StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host.(Citation: Cybereason StrifeWater Feb 2022)
WarzoneRAT	WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.(Citation: Check Point Warzone Feb 2020)
SLOTHFULMEDIA	SLOTHFULMEDIA has collected system name, OS version, adapter information, memory usage, and disk information from a victim machine.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
FALLCHILL	FALLCHILL can collect operating system (OS) version information, processor information, system name, and information about installed disks from the victim.(Citation: US-CERT FALLCHILL Nov 2017)
Frankenstein	Frankenstein has enumerated hosts, looking for the system's machine name.(Citation: Talos Frankenstein June 2019)
Turla	Turla surveys a system upon check-in to discover operating system configuration details using the `systeminfo` and `set` commands.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020)
Tropic Trooper	Tropic Trooper has detected a target system’s OS version and system volume information.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)
Operation Wocao	Operation Wocao has discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.(Citation: FoxIT Wocao December 2019)
Lazarus Group	Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: Lazarus APT January 2022)
Gamaredon Group	A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: CERT-EE Gamaredon January 2021)
APT29	APT29 used `fsutil` to check available free space before executing actions that might create large files on disk.(Citation: Microsoft Deep Dive Solorigate January 2021)
TA2541	TA2541 has collected system information prior to downloading malware on the targeted host.(Citation: Proofpoint TA2541 February 2022)
Darkhotel	Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft DUBNIUM July 2016)
APT38	APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.(Citation: CISA AA20-239A BeagleBoyz August 2020)
MuddyWater	MuddyWater has used malware that can collect the victim’s OS version and machine name.(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)
Rocke	Rocke has used uname -m to collect the name and information about the infected system's kernel.(Citation: Anomali Rocke March 2019)
Aquatic Panda	Aquatic Panda has used native OS commands to understand privilege levels and system details.(Citation: CrowdStrike AQUATIC PANDA December 2021)
Honeybee	Honeybee gathers computer name and information using the `systeminfo` command.(Citation: McAfee Honeybee)
ZIRCONIUM	ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)
BlackByte	BlackByte used various system commands and tools to pull system information during operations.(Citation: FBI BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)
SideCopy	SideCopy has identified the OS version of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)
Wizard Spider	Wizard Spider has used Systeminfo and similar commands to acquire detailed configuration information of a victim's machine. Wizard Spider has also utilized the PowerShell cmdlet `Get-ADComputer` to collect DNS hostnames, last logon dates, and operating system information from Active Directory.(Citation: DFIR Ryuk's Return October 2020)(Citation: Mandiant FIN12 Oct 2021)
Confucius	Confucius has used a file stealer that can examine system drives, including those other than the C drive.(Citation: TrendMicro Confucius APT Aug 2021)
APT32	APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.(Citation: ESET OceanLotus)(Citation: ESET OceanLotus Mar 2019)(Citation: ESET OceanLotus macOS April 2019)(Citation: FireEye APT32 April 2020)
Moses Staff	Moses Staff collected information about the infected host, including the machine names and OS architecture.(Citation: Checkpoint MosesStaff Nov 2021)
Higaisa	Higaisa collected the system volume serial number, GUID, and computer name.(Citation: PTSecurity Higaisa 2020)(Citation: Malwarebytes Higaisa 2020)
Sidewinder	Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder COVID-19 June 2020)
OilRig	OilRig has run `hostname` and `systeminfo` on a victim.(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: FireEye APT34 July 2019)(Citation: Check Point APT34 April 2021)(Citation: Symantec Crambus OCT 2023)
APT19	APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.(Citation: FireEye APT19)(Citation: Unit 42 C0d0so0 Jan 2016)
APT37	APT37 collects the computer name, the BIOS model, and execution path.(Citation: Talos Group123)
Inception	Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.(Citation: Symantec Inception Framework March 2018)
Chimera	Chimera has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information.(Citation: NCC Group Chimera January 2021)
HEXANE	HEXANE has collected the hostname of a compromised machine.(Citation: Kaspersky Lyceum October 2021)
Volt Typhoon	Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
FIN13	FIN13 has collected local host information by utilizing Windows commands `systeminfo`, `fsutil`, and `fsinfo`. FIN13 has also utilized a compromised Symantex Altiris console and LanDesk account to retrieve host information.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)
Kimsuky	Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the "systeminfo" command.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)
Sandworm Team	Sandworm Team used a backdoor to enumerate information about the infected system's operating system.(Citation: ESET Telebots July 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)
APT18	APT18 can collect system information from the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)
Magic Hound	Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
TeamTNT	TeamTNT has searched for system version, architecture, disk partition, logical volume, and hostname information.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)
Windigo	Windigo has used a script to detect which Linux distribution and version is currently installed on the system.(Citation: ESET ForSSHe December 2018)
ToddyCat	ToddyCat has collected information on bootable drives including model, vendor, and serial numbers.(Citation: Kaspersky ToddyCat Check Logs October 2023)
Ke3chang	Ke3chang performs operating system information discovery using `systeminfo` and has used implants to identify the system language and computer name.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)
Sowbug	Sowbug obtained OS version and hardware configuration from a victim.(Citation: Symantec Sowbug Nov 2017)
Windshift	Windshift has used malware to identify the computer name of a compromised host.(Citation: BlackBerry Bahamut)
Patchwork	Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server. Patchwork also enumerated all available drives on the victim's machine.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)
Moonstone Sleet	Moonstone Sleet has gathered information on victim systems.(Citation: Microsoft Moonstone Sleet 2024)
Mustang Panda	Mustang Panda has gathered system information using `systeminfo`.(Citation: Avira Mustang Panda January 2020)
RedCurl	RedCurl has collected information about the target system, such as system information and list of network connections.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)
APT42	APT42 has used malware, such as GHAMBAR and POWERPOST, to collect system information.(Citation: Mandiant APT42-charms)
Mustard Tempest	Mustard Tempest has used implants to perform system reconnaissance on targeted systems.(Citation: Microsoft Ransomware as a Service)
Play	Play has leveraged tools to enumerate system information.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
APT3	APT3 has a tool that can obtain information about the local system.(Citation: Symantec Buckeye)(Citation: evolution of pirpi)
Winter Vivern	Winter Vivern script execution includes basic victim information gathering steps which are then transmitted to command and control servers.(Citation: DomainTools WinterVivern 2021)
CURIUM	CURIUM deploys information gathering tools focused on capturing IP configuration, running application, system information, and network connectivity information.(Citation: Symantec Tortoiseshell 2019)
Blue Mockingbird	Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.(Citation: RedCanary Mockingbird May 2020)
Daggerfly	Daggerfly utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.(Citation: ESET EvasivePanda 2024)
APT41	APT41 uses multiple built-in commands such as `systeminfo` and `net config Workstation` to enumerate victim system basic configuration information.(Citation: Rostovcev APT41 2021)
Malteiro	Malteiro collects the machine information, system architecture, the OS version, computer name, and Windows product name.(Citation: SCILabs Malteiro 2021)
UNC2452	UNC2452 used `fsutil` to check available free space before executing actions that might create large files on disk.(Citation: Microsoft Deep Dive Solorigate January 2021)
FIN8	FIN8 has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.(Citation: Symantec FIN8 Jul 2023)
admin@338	admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: `ver >> %temp%\download` `systeminfo >> %temp%\download`(Citation: FireEye admin@338)
Stealth Falcon	Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.(Citation: Citizen Lab Stealth Falcon May 2016)

Контрмера	Описание
Контрмеры
System Information Discovery Mitigation	Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about the operating system and underlying hardware, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Further, Network Device CLI commands may also be used to gather detailed system information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell. In cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be useful due to benign use during normal operations.

Исследование системы

Примеры процедур

Контрмеры

Обнаружение

Ссылки