Skip to content

Remote System Information Discovery

Technique · ATTACK:ics:T0888

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:T0888",
  "title": "Remote System Information Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T0888",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
  "external_id": "T0888",
  "domain": "ics",
  "created": "2021-04-13T12:45:26.506Z",
  "modified": "2026-10-13T17:48:49.322Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [

  ]
}

Explicit source assertions (7)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:S0093 → uses → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--067932c3-0011-4ca2-9bbe-721c631e4e41

Daavid Hentunen, Antti Tikkanen June 2014 · ICS-CERT August 2018

ATTACK:ics:S0603 → uses → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d35c947-447f-4693-9ab0-32dff56e664e

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:ics:S0604 → uses → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62e818b8-38e6-42ff-9424-9a327332eb2a

ESET Industroyer

ATTACK:ics:S1072 → uses → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67e11f38-9f68-4989-8de3-da65af52063e

Industroyer2 ESET April 2022 · Industroyer2 Forescout July 2022

ATTACK:ics:M0814 → mitigates → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74ec9ce5-3155-488c-ae56-570c47a1d207

D. Parsons and D. Wylie September 2019 · Colin Gray · Josh Rinaldi April 2016 · Aditya K Sood July 2019 · Langner November 2018

ATTACK:ics:S1045 → uses → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80a69b56-337d-446a-8167-8b9f63083c4f

CISA-AA22-103A · Wylie-22

ATTACK:ics:C0063 → uses → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fadc8348-837b-4d7d-91a2-679117e5fd7b

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.