Host-information gathering is the collection of details about an endpoint or server so an attacker can judge what to do next. The data can include installed software, running services, user activity, browser artifacts, system language, security tools, and signs of how the machine is used. In cyber security, this matters because the first compromise is often only a reconnaissance step: the attacker uses host clues to decide whether the system holds credentials, access tokens, developer secrets, or other valuable material.
This behavior appears in many infostealers and post-compromise tools. After execution, malware may enumerate applications, inspect file paths, check for wallets or password stores, or infer the role of the device from usage patterns. That information can feed victim profiling, prioritization, or lateral-movement decisions. Defenders can look for unusual software discovery, inventory collection, and rapid system fingerprinting after a suspicious process starts. Limiting local secret storage, keeping endpoint protection active, and alerting on reconnaissance-like behavior all reduce the value of gathered host information.