An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the <code>systemsetup</code> configuration tool on macOS. As an example, adversaries with user-level access can execute the <code>df -aH</code> command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. <code>show version</code>).(Citation: US-CERT-TA18-106A) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)

Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)
System Information Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1082  external_id: T1082     source_name: Amazon Describe Instance  description: Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.  url: https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html     source_name: Google Instances Resource  description: Google. (n.d.). Rest Resource: instance. Retrieved March 3, 2020.  url: https://cloud.google.com/compute/docs/reference/rest/v1/instances     source_name: Microsoft Virutal Machine API  description: Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved October 8, 2019.  url: https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get     source_name: 20 macOS Common Tools and Techniques  description: Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.  url: https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/     source_name: OSX.FairyTale  description: Phile Stokes. (2018, September 20). On the Trail of OSX.FairyTale | Adware Playing at Malware. Retrieved August 24, 2021.  url: https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/     source_name: US-CERT-TA18-106A  description: US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.  url: https://www.us-cert.gov/ncas/alerts/TA18-106A     