AN1452
Analytic 1452
Windows
Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.
WinEventLog:Security
EventCode=4688
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=13, 14
[TimeWindow]
Detect multiple discovery commands executed in short succession.
[UserContext]
Scope alerts to unusual user accounts or service accounts.
AN1453
Analytic 1453
Linux
Execution of system enumeration commands such as `uname`, `df`, `uptime`, `hostname`, `lscpu`, and `cat /etc/os-release` through local terminal or scripts.
auditd:SYSCALL
execve
[CommandList]
Customize list of commands of interest (e.g., uname, lscpu, etc.)
[TerminalSessionID]
Correlate sessions for behavior context.
AN1454
Analytic 1454
macOS
Execution of system info utilities like `systemsetup`, `sw_vers`, `uname`, or `sysctl` by terminal or scripted processes.
macos:unifiedlog
log show --predicate 'process == <utility>'
[ParentProcess]
Determine if script or terminal executed the command.
[FrequencyThreshold]
Number of discovery commands in a short window.
AN1455
Analytic 1455
ESXi
Execution of `esxcli system hostname get`, `esxcli system version get`, or `esxcli hardware` commands through SSH or local shell.
esxi:vmkernel
/var/log/vmkernel.log
[SessionOrigin]
Track SSH or console-based entry points.
[CommandString]
Customize detection for expected CLI queries.
AN1456
Analytic 1456
IaaS
Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.
AWS:CloudTrail
DescribeInstances, GetConsoleOutput, DescribeImages
[IAMRoleContext]
Limit detection to non-standard identities performing these calls.
[APIFrequency]
Identify enumeration sweeps by volume.
AN1457
Analytic 1457
Network Devices
Execution of `show version`, `show hardware`, or `show system` commands through CLI via SSH or console.
networkdevice:syslog
Privilege-level command execution
[Username]
Highlight unexpected users issuing diagnostic commands.
[CommandList]
Tailor to vendor-specific command syntax.