Operating system and hardware metadata queried from a process

Siemphony@siemphonylowT1082verified in lab

MITRE's Windows analytic looks for a process retrieving OS version, architecture, patch level or hardware characteristics, and its two tuning knobs — a time window over several discovery commands, and user context — are the parts that make it a detection rather than an inventory. Sigma can express neither, so this rule captures the single-event precursor: one command line that asks for system metadata, through the built-in utilities, through the WMI, PowerShell and .NET equivalents that avoid them, or through the registry values under `Windows NT\CurrentVersion` that hold the product name and build. Matching on CommandLine survives a relocated binary and reaches the scripted forms that never launch a named utility, but it is defeated by renaming the utility — as `Image|endswith` would be too, since only `OriginalFileName` survives a rename and it does not exist for the scripted forms. A query issued in-process through the WMI COM interfaces, which is how most agents and installers actually read this data, produces no command line at all and is invisible here. The low level reflects that a single query is expected behaviour on most hosts. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0525, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "systeminfo" or ProcessCommandLine contains "msinfo32" or ProcessCommandLine contains "dxdiag" or ProcessCommandLine contains "Get-ComputerInfo" or ProcessCommandLine contains "Win32_OperatingSystem" or ProcessCommandLine contains "Win32_ComputerSystem" or ProcessCommandLine contains "Win32_Processor" or ProcessCommandLine contains "Win32_BIOS" or ProcessCommandLine contains "csproduct get" or ProcessCommandLine contains "wmic os get" or ProcessCommandLine contains "Environment]::OSVersion" or ProcessCommandLine contains "/v ProductName" or ProcessCommandLine contains "Windows NT\\CurrentVersion")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*systeminfo*" OR CommandLine="*msinfo32*" OR CommandLine="*dxdiag*" OR CommandLine="*Get-ComputerInfo*" OR CommandLine="*Win32_OperatingSystem*" OR CommandLine="*Win32_ComputerSystem*" OR CommandLine="*Win32_Processor*" OR CommandLine="*Win32_BIOS*" OR CommandLine="*csproduct get*" OR CommandLine="*wmic os get*" OR CommandLine="*Environment]::OSVersion*" OR CommandLine="*/v ProductName*" OR CommandLine="*Windows NT\\CurrentVersion*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*systeminfo*" OR TO_LOWER(process.command_line) LIKE "*msinfo32*" OR TO_LOWER(process.command_line) LIKE "*dxdiag*" OR TO_LOWER(process.command_line) LIKE "*get-computerinfo*" OR TO_LOWER(process.command_line) LIKE "*win32_operatingsystem*" OR TO_LOWER(process.command_line) LIKE "*win32_computersystem*" OR TO_LOWER(process.command_line) LIKE "*win32_processor*" OR TO_LOWER(process.command_line) LIKE "*win32_bios*" OR TO_LOWER(process.command_line) LIKE "*csproduct get*" OR TO_LOWER(process.command_line) LIKE "*wmic os get*" OR TO_LOWER(process.command_line) LIKE "*environment]::osversion*" OR TO_LOWER(process.command_line) LIKE "*/v productname*" OR TO_LOWER(process.command_line) LIKE "*windows nt\\\\currentversion*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(systeminfo|msinfo32|dxdiag|Get-ComputerInfo|Win32_OperatingSystem|Win32_ComputerSystem|Win32_Processor|Win32_BIOS|csproduct get|wmic os get|Environment\]::OSVersion|/v ProductName|Windows NT\\CurrentVersion)</field>    <description>Operating system and hardware metadata queried from a process</description>    <mitre>      <id>T1082</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 19f8bd1e-bf11-425f-8868-9f33bd092ab3

ATT&CKT1082

T1082System Information Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery recon

01 · What this rule detects

An operator orienting themselves after gaining access — enumerating domain accounts, groups, shares, trusts and privileged users, usually within minutes of landing.

02 · Telemetry you need

Process creation with full command lines
Directory service query telemetry, where it is collected
The user and host context for each command
Accurate timestamps, since the sequence and pace carry the signal

03 · How the logic works

Individually these commands are unremarkable — whoami, net group, nltest and their equivalents are all legitimate. What distinguishes reconnaissance is density: several distinct discovery commands from one account on one host inside a few minutes. A single-command rule will drown you. The workable approach is either a correlation rule counting distinct discovery commands in a window, or a rule that fires on discovery commands run by accounts that have no business running them, such as a service account.

04 · Common false positives

Administrators doing exactly this work as part of their job
Inventory, asset management and compliance scanning tools
Login scripts that query group membership
Helpdesk staff diagnosing access problems

05 · Detection maturity

Tier 1 — starting point: Matches individual discovery commands. Expect high volume.
Tier 2 — tuned: Counts distinct discovery commands per user and host inside a time window.
Tier 3 — correlated: Weights by account type and correlates with recent first-time access to the host.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Count distinct commands rather than matching any single one
Weight by the account: a service account running whoami and net group is far more interesting than a domain admin doing so
Discovery within minutes of a first-ever logon to a host is a strong pairing
Keep the alert's evidence as the full command sequence — the individual commands mean little in isolation

Declared by the author

Cloud and hypervisor guest tooling that runs its inventory as a script rather than in-process — Azure Run Command and custom script extensions, AWS SSM documents, and the VMware Tools or Citrix VDA maintenance tasks — which call Get-ComputerInfo or wmic os get on every host at boot and on each heartbeat. On a virtualised or cloud estate this is the largest single source of hits by a wide margin, and because it runs as SYSTEM it defeats MITRE's UserContext knob rather than being separated by it.
Asset inventory, patch management and licence-compliance agents, which run exactly these queries against every host on a schedule. MITRE's UserContext knob is the intended separator — exclude the service accounts those agents run under rather than removing the terms.
Helpdesk diagnostics and support scripts, where an operator runs systeminfo or msinfo32 while a ticket is open. This is the single-command case MITRE's TimeWindow knob is meant to distinguish from a reconnaissance burst, and no threshold is encoded in this rule.
Installer bootstrappers and deployment scripts that shell out to check the OS edition and build before proceeding, typically reg query on Windows NT\CurrentVersion /v ProductName or a wmic os get line in a wrapper .cmd or .ps1.

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-helpdesk-inventory-batch
A logon inventory script gathering machine facts. Every command in it is also in an attacker's discovery playbook.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — System information discovery
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1082, evaluated against their process_creation events.

Share this rule

/u/siemphony/19f8bd1e-bf11-425f-8868-9f33bd092ab3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Operating system and hardware metadata queried from a process

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it