Update T1082.yaml (#2895)

Co-authored-by: Carrie Roberts <[email protected]>
redcanaryco · Aug 3, 2024 · de8cc18 · de8cc18
1 parent a8cdef7
commit de8cc18
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/atomics/T1082/T1082.yaml b/atomics/T1082/T1082.yaml
@@ -527,4 +527,14 @@ atomic_tests:
     command: sysctl -n hw.model
     name: sh
     elevation_required: false
-
+- name: 'operating system discovery '
+  description: |-
+    operating system discovery using get-ciminstance
+    https://petri.com/getting-operating-system-information-powershell/
+  supported_platforms:
+  - windows
+  executor:
+    command: Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, ServicePackMajorVersion, OSArchitecture, CSName, WindowsDirectory | Out-null
+    name: powershell
+    elevation_required: false
+