Process creation and command-line execution of native system discovery utilities such as systeminfo, hostname, wmic, or use of PowerShell/WMI for system enumeration.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Security | EventCode=4688 |
| Command Execution (DC0064) | WinEventLog:PowerShell | EventCode=4104 |
| Field | Description |
|---|---|
| TimeWindow | Detect multiple discovery commands executed in short succession. |
| UserContext | Scope alerts to unusual user accounts or service accounts. |
Execution of system enumeration commands such as uname, df, uptime, hostname, lscpu, and cat /etc/os-release through local terminal or scripts.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Field | Description |
|---|---|
| CommandList | Customize list of commands of interest (e.g., uname, lscpu, etc.) |
| TerminalSessionID | Correlate sessions for behavior context. |
Execution of system info utilities like systemsetup, sw_vers, uname, or sysctl by terminal or scripted processes.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | macos:unifiedlog | log show --predicate 'process == |
| Field | Description |
|---|---|
| ParentProcess | Determine if script or terminal executed the command. |
| FrequencyThreshold | Number of discovery commands in a short window. |
Execution of esxcli system hostname get, esxcli system version get, or esxcli hardware commands through SSH or local shell.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | esxi:vmkernel | /var/log/vmkernel.log |
| Field | Description |
|---|---|
| SessionOrigin | Track SSH or console-based entry points. |
| CommandString | Customize detection for expected CLI queries. |
Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.
| Data Component | Name | Channel |
|---|---|---|
| Instance Enumeration (DC0075) | AWS:CloudTrail | DescribeInstances, GetConsoleOutput, DescribeImages |
| Field | Description |
|---|---|
| IAMRoleContext | Limit detection to non-standard identities performing these calls. |
| APIFrequency | Identify enumeration sweeps by volume. |
Execution of show version, show hardware, or show system commands through CLI via SSH or console.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | networkdevice:syslog | Privilege-level command execution |
| Field | Description |
|---|---|
| Username | Highlight unexpected users issuing diagnostic commands. |
| CommandList | Tailor to vendor-specific command syntax. |