Procedure examples

APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.

BlackByte used various system commands and tools to pull system information during operations.

SideCopy has identified the OS version of a compromised host.

APT3 has a tool that can obtain information about the local system.

Mustard Tempest has used implants to perform system reconnaissance on targeted systems.

Kimsuky has enumerated OS type, OS version, and other information using a script or the "systeminfo" command. Kimsuky has also obtained system information such as OS type, OS version, and system type through querying various Windows Management Instrumentation (WMI) classes including `Win32_OperatingSystem`.

admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: ver >> %temp%\download systeminfo >> %temp%\download

Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.

APT41 uses multiple built-in commands such as systeminfo and `net config Workstation` to enumerate victim system basic configuration information.

APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.

MuddyWater has used malware that can collect the victim’s OS version and machine name.

A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.

TeamTNT has searched for system version, architecture, and hostname information.

FIN7 has used csvde.exe, which is a built-in Windows command line tool, to export system information. Additionally, WsTaskLoad has gathered system information, such as operating system and hostname.

Sandworm Team used a backdoor to enumerate information about the infected system's operating system.

APT18 can collect system information from the victim’s machine.

CURIUM deploys information gathering tools focused on capturing IP configuration, running application, system information, and network connectivity information.

Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.

Mustang Panda has gathered system information using systeminfo.

ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.

Rocke has used uname -m to collect the name and information about the infected system's kernel.

Scattered Spider has executed scripts to identify the underlying operating system to ensure it uses the correct installation package for malicious payloads.

Contagious Interview has configured malicious webpages to identify the victim’s operating system by reviewing the details of the victims User-Agent of their browser.

TA2541 has collected system information prior to downloading malware on the targeted host.

APT37 collects the computer name, the BIOS model, and execution path.

Moses Staff collected information about the infected host, including the machine names and OS architecture.

OilRig has run hostname and systeminfo on a victim.

Windigo has used a script to detect which Linux distribution and version is currently installed on the system.

Higaisa collected the system GUID and computer name.

Tropic Trooper has detected a target system’s OS version.

Aquatic Panda has used native OS commands to understand privilege levels and system details.

Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.

Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.

Winter Vivern script execution includes basic victim information gathering steps which are then transmitted to command and control servers.

Turla surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands.

Storm-0501 has leveraged native Windows tools and commands such as `systeminfo` and open-source tools including OSQuery and ossec-win32 to query details about the endpoint.

RedCurl has collected information about the target system, such as system information and list of network connections.

Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.

MirrorFace has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.

Medusa Group has leveraged `cmd.exe` to identify system info `cmd.exe /c systeminfo`.

Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.

Windshift has used malware to identify the computer name of a compromised host.

Malteiro collects the machine information, system architecture, the OS version, computer name, and Windows product name.

APT42 has used malware, such as GHAMBAR and POWERPOST, to collect system information.

Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.

Sowbug obtained OS version and hardware configuration from a victim.

Wizard Spider has used Systeminfo and similar commands to acquire detailed configuration information of a victim's machine. Wizard Spider has also utilized the PowerShell cmdlet `Get-ADComputer` to collect DNS hostnames, last logon dates, and operating system information from Active Directory.

Moonstone Sleet has gathered information on victim systems.

Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.

VOID MANTICORE has gathered system information and disseminated it back to C2.