T1082

Official Description

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is an adversary's discovery of local drive, disks and/or volumes.

Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the <code>systemsetup</code> configuration tool on macOS. Adversaries may leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. <code>show version</code>).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis)

Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)

[System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)

Tactics: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Network Devices, Windows
MITRE Version: 3.0
Last Modified: Sep 11, 2026

View on MITRE ATT&CK ↗

Reported Context (386)

The attacker ran uname and hostname commands during reconnaissance through SSH. SSHole OpenSSH Flaw Exploited Within Hours; Alpine Honeypot Saw Root Access
The malware code can collect basic system information. Analysis Finds Signed “Abe Office” RAT Built to Steal Browser Data via Hidden Browsers
Backdoor.Lindnor sent the operating system version and computer name to its command-and-control server. Anubis Ransomware Attack Used Lindnor Backdoor and BYOVD Tools, but Encryption Was Blocked
The fingerprinting script collected operating-system, browser-version, and device-configuration information from visitors. Sekoia Details APT29-Linked Watering-Hole Campaign Using Patched Mobile Exploits
Injected JavaScript profiles browser and device attributes, including checking an Android device model identifier. Sekoia Links APT29 to Mobile Watering-Hole Campaign Using Hijacked Analytics Script

CVE (153)

Malware (599)

People (168)

Threat Actors (244)

MITRE ATT&CK (398)

Vendors (262)

Products (903)

Tools (544)

Industries (172)

Countries (106)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.