Procedure examples

KV Botnet Activity includes use of native system tools, such as uname, to obtain information about victim device architecture, as well as gathering other system information such as the victim's hosts file and CPU utilization.

During SharePoint ToolShell Exploitation, threat actors fingerprinted targeted SharePoint servers to identify OS version and running processes.

During Frankenstein, the threat actors used Empire to obtain the compromised machine's name.

Mustang Panda captured victim operating system type via User Agent analysis during RedDelta Modified PlugX Infection Chain Operations.

During Operation Honeybee, the threat actors collected the computer name, OS, and other system information using `cmd /c systeminfo > %temp%\ temp.ini`.

During Cutting Edge, threat actors used the ENUM4LINUX Perl script for discovery on Windows and Samba hosts.

During the Anthropic AI-orchestrated Campaign, the adversary tasked Claude Code to query databases and systems in order to identify proprietary information, including system configurations and database types.

During Juicy Mix, OilRig used a script to send the name of the compromised host via HTTP `POST` to register it with C2.

During Operation AkaiRyū, MirrorFace collected system information.

During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts.

During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.

ArcaneDoor included collection of victim device configuration information.

During Operation Wocao, threat actors discovered the OS versions of systems connected to a targeted network.

Leviathan performed host enumeration and data gathering operations on victim machines during Leviathan Australian Intrusions.