ATT&CK technique · T1082
System Information Discovery
Discovery· seen in 7 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-2843 KEV CVEsImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2853 KEV CVEsImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-6393 KEV CVEsAuthorization Bypass Through User-Controlled KeyChanging an id in a request (an IDOR) returns another user's data.
- CWE-8623 KEV CVEsMissing AuthorizationNo permission check is made before the action, so any logged-in user can perform it.
- CWE-8633 KEV CVEsIncorrect AuthorizationA permission check exists but is wrong, letting users act beyond their role.
- CWE-791 KEV CVEImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Input is echoed into a web page as script, running in other users' browsers with their session.
- CWE-891 KEV CVEImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Input is concatenated into a database query, letting attackers read or change data they shouldn't.
Controls that mitigate it (0)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
No NIST SP 800-53 mapping for this technique.
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.