Operating system and hardware metadata queried from a process

Siemphony@siemphonylowT1082verified in labPlaybook · Discovery and enumeration

MITRE's Windows analytic looks for a process retrieving OS version, architecture, patch level or hardware characteristics, and its two tuning knobs — a time window over several discovery commands, and user context — are the parts that make it a detection rather than an inventory. Sigma can express neither, so this rule captures the single-event precursor: one command line that asks for system metadata, through the built-in utilities, through the WMI, PowerShell and .NET equivalents that avoid them, or through the registry values under `Windows NT\CurrentVersion` that hold the product name and build. Matching on CommandLine survives a relocated binary and reaches the scripted forms that never launch a named utility, but it is defeated by renaming the utility — as `Image|endswith` would be too, since only `OriginalFileName` survives a rename and it does not exist for the scripted forms. A query issued in-process through the WMI COM interfaces, which is how most agents and installers actually read this data, produces no command line at all and is invisible here. The low level reflects that a single query is expected behaviour on most hosts. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0525, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Operating system and hardware metadata queried from a process2id: 19f8bd1e-bf11-425f-8868-9f33bd092ab33status: experimental4description: |5  MITRE's Windows analytic looks for a process retrieving OS version,6  architecture, patch level or hardware characteristics, and its two tuning7  knobs — a time window over several discovery commands, and user context —8  are the parts that make it a detection rather than an inventory. Sigma can9  express neither, so this rule captures the single-event precursor: one command10  line that asks for system metadata, through the built-in utilities, through11  the WMI, PowerShell and .NET equivalents that avoid them, or through the12  registry values under `Windows NT\CurrentVersion` that hold the product name13  and build. Matching on CommandLine survives a relocated binary and reaches the14  scripted forms that never launch a named utility, but it is defeated by15  renaming the utility — as `Image|endswith` would be too, since only16  `OriginalFileName` survives a rename and it does not exist for the scripted17  forms. A query issued in-process through the WMI COM interfaces, which is how18  most agents and installers actually read this data, produces no command line19  at all and is invisible here. The low level reflects that a single query is20  expected behaviour on most hosts.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0525, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T108224  - https://attack.mitre.org/detectionstrategies/DET052525author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1627tags:28  - attack.discovery29  - attack.t108230logsource:31  category: process_creation32  product: windows33detection:34  selection:35    CommandLine|contains:36      - 'systeminfo'37      - 'msinfo32'38      - 'dxdiag'39      - 'Get-ComputerInfo'40      - 'Win32_OperatingSystem'41      - 'Win32_ComputerSystem'42      - 'Win32_Processor'43      - 'Win32_BIOS'44      - 'csproduct get'45      - 'wmic os get'46      - 'Environment]::OSVersion'47      - '/v ProductName'48      - 'Windows NT\CurrentVersion'49  condition: selection50falsepositives:51  - "Cloud and hypervisor guest tooling that runs its inventory as a script rather than in-process — Azure Run Command and custom script extensions, AWS SSM documents, and the VMware Tools or Citrix VDA maintenance tasks — which call Get-ComputerInfo or wmic os get on every host at boot and on each heartbeat. On a virtualised or cloud estate this is the largest single source of hits by a wide margin, and because it runs as SYSTEM it defeats MITRE's UserContext knob rather than being separated by it."52  - "Asset inventory, patch management and licence-compliance agents, which run exactly these queries against every host on a schedule. MITRE's UserContext knob is the intended separator — exclude the service accounts those agents run under rather than removing the terms."53  - "Helpdesk diagnostics and support scripts, where an operator runs systeminfo or msinfo32 while a ticket is open. This is the single-command case MITRE's TimeWindow knob is meant to distinguish from a reconnaissance burst, and no threshold is encoded in this rule."54  - "Installer bootstrappers and deployment scripts that shell out to check the OS edition and build before proceeding, typically reg query on Windows NT\\CurrentVersion /v ProductName or a wmic os get line in a wrapper .cmd or .ps1."55level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "systeminfo" or ProcessCommandLine contains "msinfo32" or ProcessCommandLine contains "dxdiag" or ProcessCommandLine contains "Get-ComputerInfo" or ProcessCommandLine contains "Win32_OperatingSystem" or ProcessCommandLine contains "Win32_ComputerSystem" or ProcessCommandLine contains "Win32_Processor" or ProcessCommandLine contains "Win32_BIOS" or ProcessCommandLine contains "csproduct get" or ProcessCommandLine contains "wmic os get" or ProcessCommandLine contains "Environment]::OSVersion" or ProcessCommandLine contains "/v ProductName" or ProcessCommandLine contains "Windows NT\\CurrentVersion")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*systeminfo*" OR CommandLine="*msinfo32*" OR CommandLine="*dxdiag*" OR CommandLine="*Get-ComputerInfo*" OR CommandLine="*Win32_OperatingSystem*" OR CommandLine="*Win32_ComputerSystem*" OR CommandLine="*Win32_Processor*" OR CommandLine="*Win32_BIOS*" OR CommandLine="*csproduct get*" OR CommandLine="*wmic os get*" OR CommandLine="*Environment]::OSVersion*" OR CommandLine="*/v ProductName*" OR CommandLine="*Windows NT\\CurrentVersion*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*systeminfo*" OR TO_LOWER(process.command_line) LIKE "*msinfo32*" OR TO_LOWER(process.command_line) LIKE "*dxdiag*" OR TO_LOWER(process.command_line) LIKE "*get-computerinfo*" OR TO_LOWER(process.command_line) LIKE "*win32_operatingsystem*" OR TO_LOWER(process.command_line) LIKE "*win32_computersystem*" OR TO_LOWER(process.command_line) LIKE "*win32_processor*" OR TO_LOWER(process.command_line) LIKE "*win32_bios*" OR TO_LOWER(process.command_line) LIKE "*csproduct get*" OR TO_LOWER(process.command_line) LIKE "*wmic os get*" OR TO_LOWER(process.command_line) LIKE "*environment]::osversion*" OR TO_LOWER(process.command_line) LIKE "*/v productname*" OR TO_LOWER(process.command_line) LIKE "*windows nt\\\\currentversion*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(systeminfo|msinfo32|dxdiag|Get-ComputerInfo|Win32_OperatingSystem|Win32_ComputerSystem|Win32_Processor|Win32_BIOS|csproduct get|wmic os get|Environment\]::OSVersion|/v ProductName|Windows NT\\CurrentVersion)</field>    <description>Operating system and hardware metadata queried from a process</description>    <mitre>      <id>T1082</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 19f8bd1e-bf11-425f-8868-9f33bd092ab3

ATT&CKT1082

T1082System Information Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — System information discovery
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-helpdesk-inventory-batch
A logon inventory script gathering machine facts. Every command in it is also in an attacker's discovery playbook.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1082, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Filter out events where the CommandLine field contains specific keywords that are commonly used by legitimate system administration tools, such as systeminfo or msinfo32 with specific parameters
Add additional conditions to filter out events where the process is run by a trusted user or system account
Modify the selection to include additional keywords or commands that are specific to the organization's environment and legitimate system activity

Declared by the author

Cloud and hypervisor guest tooling that runs its inventory as a script rather than in-process — Azure Run Command and custom script extensions, AWS SSM documents, and the VMware Tools or Citrix VDA maintenance tasks — which call Get-ComputerInfo or wmic os get on every host at boot and on each heartbeat. On a virtualised or cloud estate this is the largest single source of hits by a wide margin, and because it runs as SYSTEM it defeats MITRE's UserContext knob rather than being separated by it.
Asset inventory, patch management and licence-compliance agents, which run exactly these queries against every host on a schedule. MITRE's UserContext knob is the intended separator — exclude the service accounts those agents run under rather than removing the terms.
Helpdesk diagnostics and support scripts, where an operator runs systeminfo or msinfo32 while a ticket is open. This is the single-command case MITRE's TimeWindow knob is meant to distinguish from a reconnaissance burst, and no threshold is encoded in this rule.
Installer bootstrappers and deployment scripts that shell out to check the OS edition and build before proceeding, typically reg query on Windows NT\CurrentVersion /v ProductName or a wmic os get line in a wrapper .cmd or .ps1.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects when a process queries operating system and hardware metadata, which can be an indicator of discovery and reconnaissance activity by an attacker. The rule looks for specific commands and queries that are commonly used to gather information about the system, such as systeminfo, msinfo32, and dxdiag, as well as WMI and PowerShell commands that retrieve system information.

02 · Telemetry you need

Log source: process creation
Product: Windows
Fields: CommandLine
Audit setting: process creation logging must be enabled, which may be off by default in some Windows configurations

03 · How the logic works

The rule selects events where the CommandLine field contains any of the specified keywords, such as systeminfo, msinfo32, or Get-ComputerInfo. The condition is simply that the selection must be true, meaning that if any of the keywords are found in the CommandLine field, the event will trigger the rule.

04 · Common false positives

System administration tools and scripts that use systeminfo or msinfo32 to gather system information
Software installation and update processes that query system metadata using WMI or PowerShell
Legitimate system monitoring and inventory tools that use dxdiag or wmic to gather hardware information
PowerShell scripts used by system administrators to automate tasks and gather system information

05 · Detection maturity

tier_1: The rule as written may generate a high volume of false positives and requires significant tuning to be effective.
tier_2: With proper tuning and filtering, the rule can be effective in detecting discovery and reconnaissance activity, but may still require manual review and analysis to confirm true positives.
tier_3: When correlated with other signals, such as network activity or file access patterns, the rule can be a valuable component of a comprehensive threat detection strategy, providing context and supporting evidence for incident response and remediation efforts.

Related detections1 nearby

Registry, WMIC or service queries for known VM/sandbox artifacts

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/19f8bd1e-bf11-425f-8868-9f33bd092ab3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Operating system and hardware metadata queried from a process

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it