S0096: Systeminfo
Systeminfo is a Windows utility that can be used to gather detailed information about a computer. [1]
Analyst context for executives and security teams
Systeminfo is a built-in Windows utility that can collect detailed information about a computer. Its business significance is that normal administration and adversary discovery can look similar: the same utility can help IT troubleshoot systems or help an intruder understand operating system details, patch levels, architecture, and other host context before deciding what to do next.
Executive priority
Treat this as a coverage and context problem, not as a standalone high-severity indicator. Because ATT&CK links Systeminfo to System Information Discovery and to multiple campaigns and groups, leaders should ask whether endpoint and SOC programs can distinguish expected administrative use from unusual discovery activity after initial access. This is especially relevant for incident scoping, audit evidence around monitoring, and prioritizing controls that expose attacker reconnaissance before follow-on actions occur.
Technical view
Validate whether command/process telemetry records execution of the Windows systeminfo utility, the parent process that launched it, user context, host, command line, and timing. Since the ATT&CK object has no official detection guidance and no platforms listed beyond the description identifying it as a Windows utility, detection engineering should avoid treating execution alone as malicious. Higher-value logic should correlate systeminfo execution with the related discovery technique T1082, unusual parent processes, non-administrative users, remote execution context, or clustered discovery behavior across hosts.
Likely telemetry
- Endpoint process creation events for systeminfo execution
- Command-line arguments where available
- Parent and child process relationships
- User account and logon/session context
- Host identity and asset role
Detection direction
- Baseline legitimate administrative use of systeminfo before alerting on execution alone.
- Prioritize detections where systeminfo is launched by unusual parents, from temporary or user-writable paths, by unexpected users, or during suspicious post-compromise timelines.
- Correlate with ATT&CK T1082 System Information Discovery rather than relying on the tool name as a verdict.
- Tune for false positives from IT support, inventory, troubleshooting, and compliance scripts.
- Review gaps caused by missing command-line, parent process, or endpoint telemetry, since the official ATT&CK object provides no detection text.
Mitigation priorities
- Ensure endpoint logging captures process creation, command line, user, host, and parent process data for Windows systems where this utility may be used.
- Define approved administrative tooling and expected execution patterns so SOC teams can separate routine operations from anomalous discovery.
- Use least privilege and administrative access governance to reduce unnecessary ability to perform broad host discovery in sensitive environments.
- In incident response playbooks, treat suspicious systeminfo execution as a scoping clue that may indicate reconnaissance, then look for surrounding discovery and follow-on behavior.
- Maintain asset inventory and patch visibility so defenders are not dependent on adversary-observed system details to understand exposure.
Analyst notes and limits
The relationship context shows this tool is used for ATT&CK T1082 System Information Discovery and has been associated in ATT&CK relationships with several campaigns and groups, including Operation Honeybee, FunnyDream, Operation CuckooBees, Ke3chang, Turla, APT29, admin@338, Naikon, Threat Group-3390, OilRig, Magic Hound, Orangeworm, and Volt Typhoon. These relationships support defensive prioritization, but they should not be read as proof of current activity in any environment.
The supplied ATT&CK object is sparse: no official detection text, no tool-level tactics, no aliases, and no explicit platform list are provided. The only platform-specific statement supported by the official description is that Systeminfo is a Windows utility. Local telemetry, baselines, and incident context are required to determine whether any observed execution is benign administration or suspicious discovery.
Systeminfo
Systeminfo is a Windows utility that can be used to gather detailed information about a computer. [1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1082 | System Information Discovery | Systeminfo can be used to gather information about the operating system.CitationTechNet Systeminfo |
Groups, software, and campaigns
G0049: OilRig
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]
G0004: Ke3chang
G0027: Threat Group-3390
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]
G0018: admin@338
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. [1]
G0019: Naikon
Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).[1] Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).[1][2]
While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.[3]
G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
G0010: Turla
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]
G0016: APT29
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]
G0071: Orangeworm
Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.[1] Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.[2]
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
C0007: FunnyDream
FunnyDream was a suspected Chinese cyber espionage campaign that targeted government and foreign organizations in Malaysia, the Philippines, Taiwan, Vietnam, and other parts of Southeast Asia. Security researchers linked the FunnyDream campaign to possible Chinese-speaking threat actors through the use of the Chinoxy backdoor and noted infrastructure overlap with the TAG-16 threat group.[1][2][3]
C0012: Operation CuckooBees
Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.[1]
C0006: Operation Honeybee
Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | b4be6e166ba4… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
TechNet Systeminfo
Microsoft. (n.d.). Systeminfo. Retrieved April 8, 2016.
Open source URL -
[2]
mitre-attack S0096Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.