Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0525 — System Discovery via Native and Remote Utilities
DET0525

System Discovery via Native and Remote Utilities

6 analytic(s) · 1 technique(s) detected

Analytics

6
AN1452 Analytic 1452
Windows

Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.

WinEventLog:Security EventCode=4688 WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=13, 14
[TimeWindow] Detect multiple discovery commands executed in short succession.
[UserContext] Scope alerts to unusual user accounts or service accounts.
AN1453 Analytic 1453
Linux

Execution of system enumeration commands such as `uname`, `df`, `uptime`, `hostname`, `lscpu`, and `cat /etc/os-release` through local terminal or scripts.

auditd:SYSCALL execve
[CommandList] Customize list of commands of interest (e.g., uname, lscpu, etc.)
[TerminalSessionID] Correlate sessions for behavior context.
AN1454 Analytic 1454
macOS

Execution of system info utilities like `systemsetup`, `sw_vers`, `uname`, or `sysctl` by terminal or scripted processes.

macos:unifiedlog log show --predicate 'process == <utility>'
[ParentProcess] Determine if script or terminal executed the command.
[FrequencyThreshold] Number of discovery commands in a short window.
AN1455 Analytic 1455
ESXi

Execution of `esxcli system hostname get`, `esxcli system version get`, or `esxcli hardware` commands through SSH or local shell.

esxi:vmkernel /var/log/vmkernel.log
[SessionOrigin] Track SSH or console-based entry points.
[CommandString] Customize detection for expected CLI queries.
AN1456 Analytic 1456
IaaS

Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.

AWS:CloudTrail DescribeInstances, GetConsoleOutput, DescribeImages
[IAMRoleContext] Limit detection to non-standard identities performing these calls.
[APIFrequency] Identify enumeration sweeps by volume.
AN1457 Analytic 1457
Network Devices

Execution of `show version`, `show hardware`, or `show system` commands through CLI via SSH or console.

networkdevice:syslog Privilege-level command execution
[Username] Highlight unexpected users issuing diagnostic commands.
[CommandList] Tailor to vendor-specific command syntax.

Detected Techniques

1

Details

MITRE ID
DET0525
STIX ID
x-mitre-detection-strategy--75161d5e-2b6d-4112-ab4d-338f70ea97f0
Analytics
6
Techniques Detected
1
By Tactic
Discovery
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.