Sidewinder has used malware to collect information on files and directories.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Sidewinder has used malware to collect information on network interfaces, including the MAC address.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

Sidewinder has used tools to obtain the current system time.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Sidewinder has used tools to identify running processes on the victim's machine.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder COVID-19 June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Sidewinder has used tools to identify the user of a compromised host.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|