BIOC
Informational
✕
System information discovery
System information discovery using one of these bash utilities - lshw -short, uptime, uname -a.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Discovery
- Status:
- Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: System Information Discovery (T1082)
Indicator:
Process action type = execution AND target process name = lshw , uptime , uname AND target process cmd = *-a* , *-short* , *uptime* Process initiated by =~ (ba|z|fi|tc|c|k)?sh , cgo name =~ (ba|z|fi|tc|c|k)?sh , os parent name =~ (ba|z|fi|tc|c|k)?sh Host host os = linux , macos
Preventable: no