System Information Discovery is attacker activity that collects details about a host after access is gained. The goal is to learn what the machine is, how it is configured, and whether it is useful for the next stage of intrusion. Common checks include operating system version, CPU and memory, disk space, network interfaces, running processes, privileges, and signs of virtualized or hardened environments.
This matters because discovery helps attackers choose payloads and prioritize targets. A host with strong hardware may be attractive for cryptomining, while a server with valuable credentials may lead to lateral movement or data theft. Defenders often see this behavior as a sequence of low-noise commands in shells, SSH sessions, or malware execution. Monitoring for unusual use of tools such as uname, lscpu, whoami, ip, and df can reveal reconnaissance early, especially when it follows a successful login or privilege escalation.