Atomic Red T1082

Invoke-AtomicTest T1082

Executes the system information discovery atomic test (T1082) with Atomic Red Team, validating detection of host reconnaissance.

Run it in the purple team lab when you want to validate detection of host reconnaissance: the T1082 atomic collects system information (systeminfo, hostname, configuration queries) and the team verifies what was detected — Sysmon Event 1 (systeminfo), SIEM rules, EDR. It's validation of discovery detection: the attacker's phase that collects before acting. In purple teaming, the atomic validates reconnaissance rules and the result feeds the matrix.

Don't run it in production without planning: information collection generates processes and queries — the lab is the place (although the T1082 atomic is among the quietest: systeminfo is legitimate). And note: detection of collection (systeminfo) is hard because it's a legitimate tool — the rule relies on context (volume, combination with other techniques); the atomic validates that telemetry logs the execution, real detection is in correlation. The 'detected' result depends on the deployed reconnaissance rule (systeminfo + others); the isolated atomic may trigger nothing — and that's a valid exercise outcome.