MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Discovery/ T1082

T1082System Information Discovery

T1082 — System Information Discovery is a MITRE ATT&CK technique in the Discovery tactic. Clankerusecase tracks 24 detection use cases covering it and 13 threat-intel articles citing it.

Discovery

View on the matrix → Filter Detection Library MITRE official spec ↗

24Use cases

13Articles

0Sub-techniques

1Tactic

Use cases covering this technique (24)

Cisco ASA - Reconnaissance Command Activity ESCU actions · hunting P Cisco IOS XE Reconnaissance Command Activity ESCU actions · hunting P ESXi System Information Discovery ESCU actions · alerting P Linux Auditd Kernel Module Enumeration ESCU actions · hunting P Linux Kernel Module Enumeration ESCU actions · hunting P System Information Discovery Detection ESCU actions · alerting P Web Servers Executing Suspicious Processes ESCU actions · alerting P Windows Information Discovery Fsutil ESCU actions · hunting P Windows Post Exploitation Risk Behavior ESCU actions · alerting P Windows PowerShell Invoke-RestMethod IP Information Collection ESCU actions · hunting P Windows PsTools Recon Usage ESCU actions · hunting P Windows WinPEAS PowerShell Script Execution ESCU actions · alerting P Windows Wmic CPU Discovery ESCU actions · hunting P Windows Wmic DiskDrive Discovery ESCU actions · hunting P Windows Wmic Memory Chip Discovery ESCU actions · hunting P Windows Wmic Network Discovery ESCU actions · hunting P Windows Wmic Systeminfo Discovery ESCU actions · hunting P Detect attackers scanning for vulnerable JBoss servers ESCU actions · alerting P Splunk Information Disclosure in Splunk Add-on Builder ESCU actions · hunting P [LLM] System-recon commands executed under Flowise node/shell context Bespoke actions · hunting DSPDDCS [LLM] OctLurk victim-fingerprinting recon command burst (chcp 1256 + qwinsta + klist + tasklist) Bespoke actions · hunting DSPDDCS [LLM] Python process spawning shell with TeamPCP recon chain (hostname; whoami; uname; ip addr fallback) Bespoke actions · alerting DSΣPDDCS [LLM] Package-manager install hook spawning host-recon curl/wget exfil (pre.sh pattern) Bespoke install · alerting DSΣPDDCS [LLM] npm dropper DNS exfil to pkgio.com / game-note.com (gxm-reference campaign) Bespoke c2 · alerting DSΣPCS

Articles citing this technique (13)

crit [GHSA / CRITICAL] CVE-2026-69255: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified art-128

crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169

crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188

crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351

crit OceanLotus: From external espionage to domestic targeting art-388

crit FrostyNeighbor: Fresh mischief and digital shenanigans art-481

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500

crit litellm: Credential Stealer Hidden in PyPI Wheel art-587

crit Sednit reloaded: Back in the trenches art-629

crit DynoWiper update: Technical analysis and attribution art-717

crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758

crit The rising trend of malicious packages in open source ecosystems art-1827

crit Targeted npm dependency confusion attack caught red-handed art-2296