Techniques › T1518.002 › AN0241
AN0241 Analytic 0241
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defender observes use of CLI tools (
find, grep, ls, dpkg, rpm, systemctl, ps aux) to discover backup agents or config files (e.g., rsnapshot, duplicity, veeam). This often includes command lines that recursively search /etc/, /opt/, or /var/ directories for keywords like backup, and parent-child relationships involving shell or Python scripts.</p>- Detects
- T1518.002 Backup Software Discovery
- Part of
- DET0088 Backup Software Discovery via CLI, Registry, and Process Inspection (T1518.002)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: Execution of discovery commands targeting backup binaries, processes, or config paths | DC0032 Process Creation |
| auditd:PATH | Read access to known backup software configuration files (e.g., /etc/rsnapshot.conf, /opt/veeam/config.ini) | DC0055 File Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BackupConfigPaths | Directory paths and filenames related to backup agents |
ToolchainScope | Shells, interpreters, or binaries used by attacker scripts for discovery |