The Appraisal — Why the First Question Is Always About the CPU

TI-2026-070B · Series: 🗺️ The Map and the Territory · TLP:WHITE · 2026-07-09

070A found that half of everything an intruder does is System Information Discovery. This is why. It isn't reconnaissance — it's an appraisal. The attacker is not casing the house. They are pricing it.

📋 The Short Version

We call it "reconnaissance," and the word is wrong. Reconnaissance is an espionage frame — it implies the intruder is learning the target to exploit it. But watch what they actually type after breaking in, and it decomposes into three questions no spy would ask and every buyer would:

1. What is the compute worth? — CPU model, core count, and above all the GPU.
2. How long will I keep it? — is an admin watching, and is the box idle enough to steal from quietly?
3. Is it even real? — or is this a honeypot with fake binaries?

That is not intelligence gathering. That is due diligence. The intruder is an appraiser walking through a property with a clipboard, and the number at the bottom of the clipboard decides whether they drop a backdoor key or walk away.

Confidence: HIGH on the command decomposition. MEDIUM on the strict "good appraisal → persist" causation — the honeypot shows the sequence, but the verdict executes partly off-box.

1. The Clipboard

Here is the appraisal palette — the system-survey commands, sorted by what they measure:

Every column is a line item on a valuation. None of it is about the data on the machine.

2. Line One: What Is the Compute Worth?

The clearest proof that this is pricing, not curiosity, is a single observed command:

uname -a && echo '---SEP---' && nproc && echo '---SEP---' && nvidia-smi --query-gpu=...

Read it as what it is: a structured report. Kernel, then a delimiter, then the core count, then a delimiter, then the GPU spec. No human reads output formatted with ---SEP--- separators. A script does — off-box, to parse the three fields and assign the machine a price.

The pricing model is simple. Cores set the mining hashrate. Memory sets what will run. And the GPU is the multiplier that turns a cheap CPU-Monero host into something genuinely valuable.

3. The GPU Is the Crown Jewel

414 commands go looking for a GPU. An intruder after your files has no use for nvidia-smi. An intruder pricing your compute cares about almost nothing else, because a discrete GPU is the single largest number on the appraisal.

For years that meant crypto. Increasingly it means AI compute — the same GPUs that mine also train and infer, and demand for stolen inference capacity is rising exactly as the credential dictionary added claude as a username (069A). The appraisal has repriced for the AI era.

(This estate runs an RTX 4060 Ti. Every one of those 414 probes was, in effect, asking the price of the most expensive part in the rack.)

4. Line Two: How Long Will I Keep It?

A machine is worth less if you cannot hold it. So the appraisal also prices tenancy:

• who / w — 541 times. Is a human administrator logged in right now? A watched box is a bad mining host: the moment the CPU pins at 100%, someone notices and evicts you.
• uptime / load — 511 times. Is the box idle? An already-busy server hides a miner poorly and has less spare compute to steal.

No exploit needs this. A buyer discounting an asset with a short or risky lease needs exactly this. The operator is estimating the holding period before the rightful owner reclaims the property.

5. Line Three: Is It Even Real?

Before spending anything, the appraiser checks the property isn't a stage set. 168 commands run reality checks — ls -lh $(which ls) and similar — because honeypots and sandboxes ship fake or stubbed binaries, and a backdoor key dropped into a honeypot is both a wasted key and a leaked artifact that helps defenders.

The irony writes itself: those 168 checks all ran inside our honeypot, and the sessions continued anyway. But the intent is sound commerce — verify the goods are genuine before you pay.

6. The Verdict

The appraisal ends in a decision, and the decision is binary:

• Appraises well → drop the authorized_keys backdoor (T1098, 070A) and enroll the machine.
• Appraises poorly, or reads as a sandbox → abandon it and move to the next IP.

The recon is the decision procedure. This is why T1082 dominates 070A's technique count: it is not one step among many, it is the gate every compromise passes through. Curiosity would be occasional. A price check is mandatory, every time, because the whole operation is a business that only keeps inventory worth keeping.

7. What This Means

The frame is the finding. Commodity intrusion is not espionage with a lighter touch; it is a compute market. The machine is priced, not cased. The crown jewels are the silicon and the network position — not the data — which is precisely why a defense built to stop exfiltration watches the wrong door. The intruder never wanted your files. They wanted your GPU and your idle cycles.

For defense, the gift is the same as always. The appraisal palette — a burst of uname + nproc + nvidia-smi + w + uptime within seconds of a login — is what a legitimate user almost never does and what nearly every commodity intruder does first. Alert on the appraisal burst. It is the earliest, most common, and cheapest-to-detect moment in the entire intrusion, and its very boringness is what makes it reliable.

The map (ATT&CK) calls this T1082 and moves on. The territory shows it is the hinge the whole commodity economy turns on: what is this machine worth, and can I keep it long enough to matter?

Investigation Metadata

Cross-references: TI-2026-070A (The Map and the Territory — T1082 is 48% of commands) · TI-2026-010 (The GPU Hunter — the cryptomining economy the appraisal feeds) · TI-2026-052A (The Family Tree — the cpuinfo appraisal signature) · TI-2026-069A (The Open Armory — the AI-era repricing).