iSystem command

The iSystem command returns information about the client system where the rule is executed.

Note
Exploit Prevention is not supported in the ARM architecture.

iSystem param

Parameter	Returns
version	Version of the operating system in the format major.minor.build.
major	Major version of the operating system.
minor	Minor version of the operating system.
build	Build number of the operating system.
csd	CSD value. Usually, this is the Service Pack in the form of a string, such as "Service Pack 1".
platform	String with the platform name, for example, "Windows 7".
type	System type: Workstation Server Unknown
cpu_arch	CPU architecture: 320 for 32-bit CPU 640 for 64-bit AMD type CPU 641 for 4-bit Itanium type CPU
os_arch	Operating system architecture: 320 for 32-bit operating system 640 for 64-bit operating system
install_dir	Location of the Windows installation directory.
sys32_dir	Location of the System32 folder.
users_folders folder_types	List of folder locations for all users created on the system. You can specify the types of folders to return. The valid folder types are listed in HKEY_USERS\<user sid>\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders In addition, you can specify these special folder types: Temp — All temp folders on the system Profile — All users' profile root folder Downloads — All users' download locations -no_defaults —All folders that are not changed from their default values.

For more Expert Rules examples, visit the Trellix Github repository.