← Back to ATT&CK index
T1082
System Information Discovery
View on attack.mitre.org →4 syscalls implement this technique
- NtQueryKey
Returns metadata about an open registry key — name, class, subkey/value counts, last-write time.
- NtEnumerateBootEntries
Returns a packed array of BOOT_ENTRY structures describing every registered firmware boot option.
- NtQueryBootEntryOrder
Reads the firmware's ordered list of BOOT_ENTRY IDs — the sequence the platform will attempt at next power-on.
- NtEnumerateDriverEntries
Returns a packed list of every registered EFI_DRIVER_ENTRY — the UEFI Driver#### variables dispatched before the boot manager.