System Information Discovery

One of the first things an attacker does after landing on a host: figure out what it actually is. OS version, patch level, hostname, hardware specs, installed security software, all of it basic situational awareness that shapes every decision that follows, from which exploits might work to whether this machine is worth pursuing further.

Every one of the commands involved (systeminfo, hostname, ver on Windows; uname -a on Linux) is a completely normal administrative tool. There's nothing inherently malicious about running them. Context is everything.

This is reconnaissance, and it's nearly universal. Almost every intrusion includes some version of it early on, often within seconds of establishing a foothold, well before any destructive or high-value action. Attackers use it to confirm they landed somewhere useful, check whether they're in a sandbox or virtual machine (a sign of being watched), and identify what security tooling they'll need to evade.

It's rarely the interesting part of an intrusion on its own, but it's often the earliest reliable signal that something has started, well before credential theft or lateral movement produces louder alerts.

Data source: endpoint process-creation telemetry (Sysmon Event ID 1), where a shared parent process ID ties the short burst of discovery commands into one action

{
  "host": {
    "name": "APP01"
  },
  "event": {
    "action": "start",
    "category": "process"
  },
  "process": {
    "name": "systeminfo.exe",
    "parent": {
      "name": "cmd.exe"
    },
    "command_line": "systeminfo"
  }
}

Prebuilt Elastic rule: Whoami Process Activity

No single execution of a discovery command means much, since these run constantly for legitimate reasons. The pattern worth hunting is several different discovery commands run in quick succession from the same session, especially shortly after a new process tree starts, right after something else (a phishing payload, a newly spawned shell) has just landed.

Hunting manually: group process-creation events by host and a short time window (a few minutes), and look for clusters of systeminfo.exe, whoami.exe, hostname.exe, and similar commands run back-to-back rather than in isolation.

IT staff, monitoring agents, and legitimate scripts run these exact commands constantly as part of normal operations. Help desk troubleshooting, inventory tools, and automated health checks all rely on them.

The distinguishing signal is context: a known monitoring service account running systeminfo on a schedule is expected; the same commands run interactively by a regular user account, or run in a tight burst immediately following a suspicious parent process (a just-opened macro document, an unexpected script host), is the pattern worth escalating. Baseline your known automation and IT-tooling accounts so their routine discovery activity doesn't compete for attention with a genuine intrusion's early reconnaissance.

• MITRE ATT&CK T1082: System Information Discovery
• Elastic Security: Whoami Process Activity

1 scenario in this catalog covers T1082. We don't name it — identifying the technique is part of what a scenario grades. Explore the dashboard →