Threat intelligence / Technique

System Information Discovery

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is an adversary's discovery of local drive, disks and/or volumes. Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. show version ).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis) Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

430 recorded

Relationships

mapped-to

from Active OS Fingerprinting

Technique

mapped-to

from Passive OS Fingerprinting

Technique

mapped-to

from System Footprinting

Technique

uses

from 4H RAT

Malware

uses

from AcidPour

Malware

uses

from Action RAT

Malware

uses

from admin@338

Group

uses

from ADVSTORESHELL

Malware

uses

from Agent Tesla

Malware

uses

from Akira

Malware

uses

from Amadey

Malware

uses

from Anchor

Malware

uses

from Anthropic AI-orchestrated Campaign

Campaign

uses

from AppleJeus

Malware

uses

from AppleSeed

Malware

uses

from APT18

Group

uses

from APT19

Group

uses

from APT3

Group

uses

from APT32

Group

uses

from APT37

Group

uses

from APT38

Group

uses

from APT41

Group

uses

from APT42

Group

uses

from Aquatic Panda

Group

uses

from ArcaneDoor

Campaign

uses

from Aria-body

Malware

uses

from AshTag

Malware

uses

from Astaroth

Malware

uses

from AuTo Stealer

Malware

uses

from Avenger

Malware

uses

from Azorult

Malware

uses

from BabyShark

Malware

uses

from BackConfig

Malware

uses

from Backdoor.Oldrea

Malware

uses

from BACKSPACE

Malware

uses

from BADCALL

Malware

uses

from BADFLICK

Malware

uses

from BADHATCH

Malware

uses

from BadPatch

Malware

uses

from Bankshot

Malware

uses

from Bazar

Malware

uses

from BeaverTail

Malware

uses

from BISCUIT

Malware

uses

from Bisonal

Malware

uses

from Black Basta

Malware

uses

from BlackByte

Group

uses

from BlackByte Ransomware

Malware

uses

from BlackCat

Malware

uses

from BlackEnergy

Malware

uses

from BLINDINGCAN

Malware

uses

from BLUELIGHT

Malware

uses

from Blue Mockingbird

Group

uses

from BOLDMOVE

Malware

uses

from Bonadan

Malware

uses

from BoomBox

Malware

uses

from Brave Prince

Malware

uses

from BUBBLEWRAP

Malware

uses

from Bumblebee

Malware

uses

from Bundlore

Malware

uses

from CaddyWiper

Malware

uses

from Cadelspy

Malware

uses

from Cannon

Malware

uses

from Carberp

Malware

uses

from Cardinal RAT

Malware

uses

from CARROTBAT

Malware

uses

from Caterpillar WebShell

Malware

uses

from Chaes

Malware

uses

from CharmPower

Malware

uses

from ChChes

Malware

uses

from Chrommme

Malware

uses

from Clambling

Malware

uses

from cmd

Tool

uses

from Comnie

Malware

uses

from Contagious Interview

Group

uses

from CORESHELL

Malware

uses

from Covenant

Tool

uses

from CozyCar

Malware

uses

from Crimson

Malware

uses

from Cuckoo Stealer

Malware

uses

from CURIUM

Group

uses

from Cutting Edge

Campaign

uses

from Cyclops Blink

Malware

uses

from Daggerfly

Group

uses

from DarkComet

Malware

uses

from DarkGate

Malware

uses

from Darkhotel

Group

uses

from DarkTortilla

Malware

uses

from DarkWatchman

Malware

uses

from DEADEYE

Malware

uses

from Denis

Malware

uses

from Derusbi

Malware

uses

from Diavol

Malware

uses

from Diskpart

Tool

uses

from DownPaper

Malware

uses

from Dridex

Malware

uses

from DropBook

Malware

uses

from dsquery

Tool

uses

from Dtrack

Malware

uses

from DUSTTRAP

Malware

uses

from DustySky

Malware

uses

from Dyre

Malware

uses

from Egregor

Malware

uses

from Elise

Malware

uses

from Emissary

Malware

uses

from Empire

Tool

uses

from EnvyScout

Malware

uses

from Epic

Malware

uses

from EVILNUM

Malware

uses

from Explosive

Malware

uses

from FALLCHILL

Malware

uses

from FatDuke

Malware

uses

from Felismus

Malware

uses

from FELIXROOT

Malware

uses

from Ferocious

Malware

uses

from FIN13

Group

uses

from FIN7

Group

uses

from FIN8

Group

uses

from Final1stspy

Malware

uses

from FinFisher

Malware

uses

from FlawedAmmyy

Malware

uses

from Frankenstein

Campaign

uses

from FunnyDream

Campaign

uses

from Fysbis

Malware

uses

from Gamaredon Group

Group

uses

from Gelsemium

Malware

uses

from Get2

Malware

uses

from gh0st RAT

Malware

uses

from GlassWorm

Malware

uses

from Gold Dragon

Malware

uses

from GoldenSpy

Malware

uses

from Gomir

Malware

uses

from Gootloader

Malware

uses

from Grandoreiro

Malware

uses

from GravityRAT

Malware

uses

from Green Lambert

Malware

uses

from GRIFFON

Malware

uses

from GrimAgent

Malware

uses

from HALFBAKED

Malware

uses

from HAPPYWORK

Malware

uses

from Havoc

Malware

uses

from HAWKBALL

Malware

uses

from HermeticWiper

Malware

uses

from HEXANE

Group

uses

from HexEval Loader

Malware

uses

from HiddenFace

Malware

uses

from Higaisa

Group

uses

from Hildegard

Malware

uses

from HOPLIGHT

Malware

uses

from HotCroissant

Malware

uses

from Hydraq

Malware

uses

from IceApple

Malware

uses

from IcedID

Malware

uses

from IMAPLoader

Malware

uses

from Inception

Group

uses

from Industroyer

Malware

uses

from InnaputRAT

Malware

uses

from InvisibleFerret

Malware

uses

from InvisiMole

Malware

uses

from IronWind

Malware

uses

from Ixeshe

Malware

uses

from JPIN

Malware

uses

from jRAT

Malware

uses

from Juicy Mix

Campaign

uses

from Kapeka

Malware

uses

from KARAE

Malware

uses

from Kasidet

Malware

uses

from Kazuar

Malware

uses

from Ke3chang

Group

uses

from Kerrdown

Malware

uses

from Kessel

Malware

uses

from Kevin

Malware

uses

from KeyBoy

Malware

uses

from KEYMARBLE

Malware

uses

from Kimsuky

Group

uses

from Koadic

Tool

uses

from Kobalos

Malware

uses

from KOCTOPUS

Malware

uses

from KOMPROGO

Malware

uses

from KONNI

Malware

uses

from KV Botnet Activity

Campaign

uses

from Kwampirs

Malware

uses

from LAMEHUG

Malware

uses

from Latrodectus

Malware

uses

from Lazarus Group

Group

uses

from LazyWiper

Malware

uses

from Leviathan Australian Intrusions

Campaign

uses

from LightNeuron

Malware

uses

from LightSpy

Malware

uses

from Line Dancer

Malware

uses

from Linfo

Malware

uses

from LiteDuke

Malware

uses

from LitePower

Malware

uses

from LITTLELAMB.WOOLTEA

Malware

uses

from Lizar

Malware

uses

from LockBit 2.0

Malware

uses

from LockBit 3.0

Malware

uses

from LODEINFO

Malware

uses

from Lokibot

Malware

uses

from LoudMiner

Malware

uses

from Lucifer

Malware

uses

from Lumma Stealer

Malware

uses

from LunarMail

Malware

uses

from LunarWeb

Malware

uses

from Machete

Malware

uses

from MacMa

Malware

uses

from macOS.OSAMiner

Malware

uses

from Mafalda

Malware

uses

from Magic Hound

Group

uses

from MagicRAT

Malware

uses

from Malteiro

Group

uses

from Mango

Malware

uses

from Manjusaka

Malware

uses

from MarkiRAT

Malware

uses

from Maze

Malware

uses

from Medusa Group

Group

uses

from Medusa Ransomware

Malware

uses

from metaMain

Malware

uses

from Metamorfo

Malware

uses

from Meteor

Malware

uses

from Micropsia

Malware

uses

from Milan

Malware

uses

from MiniDuke

Malware

uses

from Mini Shai-Hulud

Malware

uses

from MirageFox

Malware

uses

from MirrorFace

Group

uses

from Misdat

Malware

uses

from Mispadu

Malware

uses

from Mis-Type

Malware

uses

from MobileOrder

Malware

uses

from MoleNet

Malware

uses

from Mongall

Malware

uses

from Moonstone Sleet

Group

uses

from MoonWind

Malware

uses

from More_eggs

Malware

uses

from Moses Staff

Group

uses

from MuddyWater

Group

uses

from MURKYTOP

Malware

uses

from Mustang Panda

Group

uses

from Mustard Tempest

Group

uses

from Naid

Malware

uses

from NanHaiShu

Malware

uses

from NavRAT

Malware

uses

from NDiskMonitor

Malware

uses

from Neoichor

Malware

uses

from Netwalker

Malware

uses

from NETWIRE

Malware

uses

from Nightdoor

Malware

uses

from Ninja

Malware

uses

from njRAT

Malware

uses

from NKAbuse

Malware

uses

from NOKKI

Malware

uses

from NOOPLDR

Malware

uses

from ObliqueRAT

Malware

uses

from OceanSalt

Malware

uses

from Octopus

Malware

uses

from OilBooster

Malware

uses

from OilRig

Group

uses

from Okrum

Malware

uses

from OopsIE

Malware

uses

from Operation AkaiRyū

Campaign

uses

from Operation CuckooBees

Campaign

uses

from Operation Honeybee

Campaign

uses

from Operation Wocao

Campaign

uses

from Orz

Malware

uses

from OSInfo

Malware

uses

from OSX_OCEANLOTUS.D

Malware

uses

from OSX/Shlayer

Malware

uses

from Pasam

Malware

uses

from Patchwork

Group

uses

from Pay2Key

Malware

uses

from Penquin

Malware

uses

from Pikabot

Malware

uses

from PinchDuke

Malware

uses

from PingPull

Malware

uses

from PipeMon

Malware

uses

from Pisloader

Malware

uses

from PLAINTEE

Malware

uses

from Play

Group

uses

from PlugX

Malware

uses

from PoetRAT

Malware

uses

from Pony

Malware

uses

from POORAIM

Malware

uses

from PoshC2

Tool

uses

from PowerDuke

Malware

uses

from PowerShower

Malware

uses

from POWERSTATS

Malware

uses

from POWRUNER

Malware

uses

from Prikormka

Malware

uses

from Proxysvc

Malware

uses

from PUBLOAD

Malware

uses

from PUNCHBUGGY

Malware

uses

from Pupy

Tool

uses

from PureCrypter

Malware

uses

from QakBot

Malware

uses

from Qilin

Malware

uses

from QuasarRAT

Tool

uses

from Raccoon Stealer

Malware

uses

from RansomHub

Malware

uses

from Raspberry Robin

Malware

uses

from RATANKBA

Malware

uses

from RCSession

Malware

uses

from Reaver

Malware

uses

from RedCurl

Group

uses

from RedDelta Modified PlugX Infection Chain Operations

Campaign

uses

from RedLeaves

Malware

uses

from RedLine Stealer

Malware

uses

from Remcos

Tool

uses

from Remsec

Malware

uses

from Revenge RAT

Malware

uses

from REvil

Malware

uses

from Rifdoor

Malware

uses

from RIFLESPINE

Malware

uses

from Rising Sun

Malware

uses

from Rocke

Group

uses

from RogueRobin

Malware

uses

from ROKRAT

Malware

uses

from RotaJakiro

Malware

uses

from Royal

Malware

uses

from RTM

Malware

uses

from RunningRAT

Malware

uses

from RustyWater

Malware

uses

from Sagerunex

Malware

uses

from Saint Bot

Malware

uses

from SampleCheck5000

Malware

uses

from Sandworm Team

Group

uses

from Sardonic

Malware

uses

from Scattered Spider

Group

uses

from SDBbot

Malware

uses

from ServHelper

Malware

uses

from ShadowPad

Malware

uses

from Shai-Hulud

Malware

uses

from Shamoon

Malware

uses

from SharePoint ToolShell Exploitation

Campaign

uses

from Shark

Malware

uses

from SharpStage

Malware

uses

from SHARPSTATS

Malware

uses

from ShimRatReporter

Tool

uses

from ShinyHunters

Group

uses

from ShrinkLocker

Malware

uses

from SHUTTERSPEED

Malware

uses

from SideCopy

Group

uses

from SideTwist

Malware

uses

from Sidewinder

Group

uses

from SILENTTRINITY

Tool

uses

from Skidmap

Malware

uses

from SLOTHFULMEDIA

Malware

uses

from SLOWDRIFT

Malware

uses

from SMOKEDHAM

Malware

uses

from Snip3

Malware

uses

from SocGholish

Malware

uses

from SodaMaster

Malware

uses

from Solar

Malware

uses

from SombRAT

Malware

uses

from SoreFang

Malware

uses

from SOUNDBITE

Malware

uses

from Sowbug

Group

uses

from Spark

Malware

uses

from SPAWNCHIMERA

Malware

uses

from SpeakUp

Malware

uses

from SpicyOmelette

Malware

uses

from SplatCloak

Malware

uses

from Squirrelwaffle

Malware

uses

from SslMM

Malware

uses

from STARWHALE

Malware

uses

from StealBit

Malware

uses

from Stealth Falcon

Group

uses

from StoneDrill

Malware

uses

from Storm-0501

Group

uses

from StreamEx

Malware

uses

from StrelaStealer

Malware

uses

from StrifeWater

Malware

uses

from Stuxnet

Malware

uses

from S-Type

Malware

uses

from SUNBURST

Malware

uses

from SVCReady

Malware

uses

from SynAck

Malware

uses

from Sys10

Malware

uses

from SYSCON

Malware

uses

from SystemBC

Malware

uses

from Systeminfo

Tool

uses

from SysUpdate

Malware

uses

from T9000

Malware

uses

from TA2541

Group

uses

from TajMahal

Malware

uses

from TeamPCP Cloud Stealer

Malware

uses

from TeamTNT

Group

uses

from ThreatNeedle

Malware

uses

from TONESHELL

Malware

uses

from TrickBot

Malware

uses

from Trojan.Karagany

Malware

uses

from Troll Stealer

Malware

uses

from Tropic Trooper

Group

uses

from Tsundere Botnet

Malware

uses

from Turian

Malware

uses

from Turla

Group

uses

from TURNEDUP

Malware

uses

from Unknown Logger

Malware

uses

from UPPERCUT

Malware

uses

from Uroburos

Malware

uses

from Ursnif

Malware

uses

from Valak

Malware

uses

from VERMIN

Malware

uses

from VOID MANTICORE

Group

uses

from Volgmer

Malware

uses

from WarzoneRAT

Malware

uses

from WellMess

Malware

uses

from Windigo

Group

uses

from WINDSHIELD

Malware

uses

from Windshift

Group

uses

from WINERACK

Malware

uses

from Wingbird

Malware

uses

from WinMM

Malware

uses

from Winnti for Windows

Malware

uses

from Winter Vivern

Group

uses

from Wizard Spider

Group

uses

from Woody RAT

Malware

uses

from XAgentOSX

Malware

uses

from XCSSET

Malware

uses

from XLoader

Malware

uses

from XORIndex Loader

Malware

uses

from YAHOYAH

Malware

uses

from yty

Malware

uses

from Zebrocy

Malware

uses

from ZeroT

Malware

uses

from Zeus Panda

Malware

uses

from ZIRCONIUM

Group

uses

from ZLib

Malware

uses

from zwShell

Malware

uses

from ZxShell

Malware

uses

from ZxxZ

Malware

9 external

References

mitre-attack

T1082

open

Amazon Describe Instance

https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html

open

Google Instances Resource

https://cloud.google.com/compute/docs/reference/rest/v1/instances

open

Varonis

https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire

open

Crowdstrike Hypervisor Jackpotting Pt 2 2021

https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/

open

Microsoft Virutal Machine API

https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get

open

20 macOS Common Tools and Techniques

https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/

open

OSX.FairyTale

https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/

open

US-CERT-TA18-106A

https://www.us-cert.gov/ncas/alerts/TA18-106A

open