Techniques › T1518
T1518 Software Discovery
discovery — ESXi, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
4
Sigma rules tagged attack.t1518
0
KEV CVEs mapped here
<p>Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.</p><p>Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally.</p><p>Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0392 Multi-Platform Software Discovery Behavior Chain v1.0
AN1100 WindowsAdversary spawns a process or script to enumerate installed software using WMI, registry, or PowerShell, potentially followed by additional discovery or evasion behavior.WinEventLog:PowerShell
Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets→ DC0064 Command ExecutionTunable:TimeWindowParentProcessAN1101 LinuxAdversary invokes 'dpkg -l', 'rpm -qa', or other package managers via shell or script to enumerate installed software.auditd:SYSCALLExecution of dpkg, rpm, or other package manager with list flag→ DC0032 Process Creationlinux:shellManual invocation of software enumeration commands via interactive shell→ DC0064 Command ExecutionTunable:ScriptNameTTYContextAN1102 macOSAdversary runs 'system_profiler SPApplicationsDataType' or queries plist files to enumerate software via Terminal or scripts.macos:unifiedlogExecution of system_profiler or osascript invoking enumeration→ DC0032 Process CreationTunable:AppScopeProcessGroupAN1103 IaaSAdversary uses cloud-native APIs or CLI (e.g., AWS Systems Manager, Azure Resource Graph) to list installed software on cloud workloads.Tunable:UserAgentInventoryTypeAN1104 ESXiAdversary uses 'esxcli software vib list' to enumerate installed VIBs, drivers, and modules.esxi:hostdHost daemon command log entries related to vib enumeration→ DC0038 Application Log ContentTunable:HostAccessModeScriptChain
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1518
Author: Nikita Nazarov, oscd.community
· 2020-10-16 (modified 2022-12-02) · logsource: product=windows category=ps_script · 2650dd1a-eb2a-412d-ac36-83f06c4f2282
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Nikita Nazarov, oscd.community
· 2020-10-16 (modified 2022-10-09) · logsource: product=windows category=process_creation · e13f668e-7f95-443d-98d2-1816a7648a7b
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.