🎯 System Information Discovery

The items that name it 8

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  writeup2026-10-30It is written here as System Information Discovery (T1082).

  Runtime initiated a Windows version registry query.

• Malicious Claude Code extension on Cursor planted SSH backdoors
  article2026-10-30

  Collects username, hostname, public IP address, Git email and names of credential-related environment variables, and sends them to the attacker's server

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29

  Installer enumerated installed .NET runtimes using dotnet --list-runtimes during the installation workflow.

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23

  Workflows detect each runner's processor architecture before downloading matching payload.

• Socket: Operation Muck and Load
  writeup2026-07-16

  Discovery activity observed in dynamic analysis.

• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeup2026-07-15

  Collection of Windows version, hostname, CPU, GPU, motherboard, disk, screen resolution/scaling written to Google Sheets

• Socket: 5 Malicious NuGet Packages Target Chinese .NET Developers
  writeup2026-05-07

  Test victim identity (hostname NEW-4V, username oljwe4y98) recovered, consistent with reconnaissance/discovery.

• BufferZoneCorp Malicious Gems & Go Modules
  writeup2026-05-06