Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Security | EventCode=4688 |
| WinEventLog:Sysmon | EventCode=1 | |
| Command Execution (DC0064) | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Windows Registry Key Modification (DC0063) | WinEventLog:Sysmon | EventCode=13, 14 |
| Field | Description |
|---|---|
| TimeWindow | Detect multiple discovery commands executed in short succession. |
| UserContext | Scope alerts to unusual user accounts or service accounts. |
Execution of system enumeration commands such as uname, df, uptime, hostname, lscpu, and cat /etc/os-release through local terminal or scripts.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Field | Description |
|---|---|
| CommandList | Customize list of commands of interest (e.g., uname, lscpu, etc.) |
| TerminalSessionID | Correlate sessions for behavior context. |
Execution of system info utilities like systemsetup, sw_vers, uname, or sysctl by terminal or scripted processes.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | macos:unifiedlog | log show --predicate 'process == |
| Field | Description |
|---|---|
| ParentProcess | Determine if script or terminal executed the command. |
| FrequencyThreshold | Number of discovery commands in a short window. |
Execution of esxcli system hostname get, esxcli system version get, or esxcli hardware commands through SSH or local shell.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | esxi:vmkernel | /var/log/vmkernel.log |
| Field | Description |
|---|---|
| SessionOrigin | Track SSH or console-based entry points. |
| CommandString | Customize detection for expected CLI queries. |
Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.
| Data Component | Name | Channel |
|---|---|---|
| Instance Enumeration (DC0075) | AWS:CloudTrail | DescribeInstances, GetConsoleOutput, DescribeImages |
| Field | Description |
|---|---|
| IAMRoleContext | Limit detection to non-standard identities performing these calls. |
| APIFrequency | Identify enumeration sweeps by volume. |
Execution of show version, show hardware, or show system commands through CLI via SSH or console.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | networkdevice:syslog | Privilege-level command execution |
| Field | Description |
|---|---|
| Username | Highlight unexpected users issuing diagnostic commands. |
| CommandList | Tailor to vendor-specific command syntax. |