Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1082_system-information-discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
Passed 18 of 24 test cases with the skill, and 10 of 24 without it.
and 7 more in the full report
8 fixed10 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Provide the specific elevated lsmod filtering pattern used in Atomic Red Team scripts to identify VMware guest balloon or vmxnet network drivers.
| Checked | Without skill | With skill |
|---|---|---|
| Executes sudo lsmod with grep filtering. | Missed | Passed |
| Filters for module name vmw_baloon. | Passed | Passed |
| Filters for module name vmxnet. | Passed | Passed |
The instructions your model reads when the skill loads.
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as system hostname get and system version get.
Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.
System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.
Platforms: ESXi, IaaS, Linux, macOS, Network Devices, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Identify System Info. Upon execution, system info and time info will be displayed.
Supported Platforms: windows
systeminfo
test cases passed, vs 10 / 24 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.