Techniques › T1518 › T1518.002
T1518.002 Backup Software Discovery
discovery — Windows, macOS, Linux · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1518.002
0
KEV CVEs mapped here
<p>Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as Data Destruction, Inhibit System Recovery, or Data Encrypted for Impact.</p><p>Commands that can be used to obtain security software information are netsh,
reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0088 Backup Software Discovery via CLI, Registry, and Process Inspection (T1518.002) v1.0
AN0240 WindowsDefender observes execution of commands like
tasklist,sc query,reg query, or PowerShell WMI/Registry queries targeting known backup products (e.g., Veeam, Acronis, CrashPlan). Behavior often includes parent-child lineage involving PowerShell or cmd.exe with discovery syntax, and enumeration of services, directories, or registry paths tied to backup software.Tunable:KnownBackupVendorsUserContextScopeSuspiciousParentProcessesAN0241 LinuxDefender observes use of CLI tools (find,grep,ls,dpkg,rpm,systemctl,ps aux) to discover backup agents or config files (e.g., rsnapshot, duplicity, veeam). This often includes command lines that recursively search/etc/,/opt/, or/var/directories for keywords likebackup, and parent-child relationships involving shell or Python scripts.auditd:SYSCALLexecve: Execution of discovery commands targeting backup binaries, processes, or config paths→ DC0032 Process Creationauditd:PATHRead access to known backup software configuration files (e.g., /etc/rsnapshot.conf, /opt/veeam/config.ini)→ DC0055 File AccessTunable:BackupConfigPathsToolchainScopeAN0242 macOSDefender detects execution ofmdfind,launchctl, or GUI-based enumeration (e.g.,/Applications/Time Machine.app) along with command-line usage offind,grep, orsystem_profilerto identify installed backup tools like Time Machine, Carbon Copy Cloner, or Backblaze. Often triggered from Terminal sessions or within post-exploitation scripts.macos:unifiedlogProcess execution logs showing discovery commands like mdfind, system_profiler, or launchctl list→ DC0032 Process Creationmacos:unifiedlogRead access to Time Machine plist files or CCC configurations in ~/Library/Preferences/→ DC0055 File AccessTunable:InstallLocationScopeKnownAppPlistPaths
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1518.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1518) 4
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nikita Nazarov, oscd.community
· 2020-10-16 (modified 2022-12-02) · logsource: product=windows category=ps_script · 2650dd1a-eb2a-412d-ac36-83f06c4f2282
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Nikita Nazarov, oscd.community
· 2020-10-16 (modified 2022-10-09) · logsource: product=windows category=process_creation · e13f668e-7f95-443d-98d2-1816a7648a7b
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.