Cross-source coverage
T1518 / ATT&CK
Software Discovery
59 rules · 58 families across 8 sources.
1 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally.
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.
- Tactics
- Discovery
- Platforms
- ESXi · IaaS · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:PowerShellauditd:SYSCALLlinux:shellmacos:unifiedlogAWS:CloudTrailesxi:shellesxi:hostd
How MITRE says to detect it DET0392
Multi-Platform Software Discovery Behavior Chain
Windows Analytic 1100
Adversary spawns a process or script to enumerate installed software using WMI, registry, or PowerShell, potentially followed by additional discovery or evasion behavior.
WinEventLog:SecurityEventCode=4688WinEventLog:PowerShellExecution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets
Linux Analytic 1101
Adversary invokes 'dpkg -l', 'rpm -qa', or other package managers via shell or script to enumerate installed software.
auditd:SYSCALLExecution of dpkg, rpm, or other package manager with list flaglinux:shellManual invocation of software enumeration commands via interactive shell
macOS Analytic 1102
Adversary runs 'system_profiler SPApplicationsDataType' or queries plist files to enumerate software via Terminal or scripts.
macos:unifiedlogExecution of system_profiler or osascript invoking enumerationauditd:SYSCALLCommand line arguments including SPApplicationsDataType
IaaS Analytic 1103
Adversary uses cloud-native APIs or CLI (e.g., AWS Systems Manager, Azure Resource Graph) to list installed software on cloud workloads.
AWS:CloudTrailssm:ListInventoryEntriesAWS:CloudTrailssm:GetCommandInvocation
ESXi Analytic 1104
Adversary uses 'esxcli software vib list' to enumerate installed VIBs, drivers, and modules.
esxi:shellesxcli software vib listesxi:hostdHost daemon command log entries related to vib enumeration
Sub-techniques with coverage
Counted in the 59 above — a rule tagged a sub-technique covers this technique too.
socfortress/Wazuh-Rules
25 rules · 24 families+ 15 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
SigmaHQ/sigma
13 rules| Detection | Severity | Format |
|---|---|---|
| HackTool - WinPwn Execution | High | Sigma |
| HackTool - WinPwn Execution - ScriptBlock | High | Sigma |
| Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE | High | Sigma |
| Detected Windows Software Discovery | Medium | Sigma |
| Detected Windows Software Discovery - PowerShell | Medium | Sigma |
| Security Software Discovery - MacOs | Medium | Sigma |
| Security Software Discovery Via Powershell Script | Medium | Sigma |
| Security Tools Keyword Lookup Via Findstr.EXE | Medium | Sigma |
| System Integrity Protection (SIP) Disabled | Medium | Sigma |
| Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet | Low | Sigma |
+ 3 more from SigmaHQ/sigma → showing the 10 highest-severity
elastic/detection-rules
11 rules| Detection | Severity | Format |
|---|---|---|
| AWS SSM Inventory Reconnaissance by Rare User | Medium | Elastic TOML |
| ESXI Discovery via Find | Medium | Elastic TOML |
| ESXI Discovery via Grep | Medium | Elastic TOML |
| Security Software Discovery via Grep | Medium | Elastic TOML |
| Enumeration Command Spawned via WMIPrvSE | Low | Elastic TOML |
| Pluggable Authentication Module (PAM) Version Discovery | Low | Elastic TOML |
| Polkit Version Discovery | Low | Elastic TOML |
| Suspicious which Enumeration | Low | Elastic TOML |
| Tool Enumeration Detected via Defend for Containers | Low | Elastic TOML |
| Unusual Kernel Module Enumeration | Low | Elastic TOML |
+ 1 more from elastic/detection-rules → showing the 10 highest-severity
Bert-JanP/Hunting-Queries-Detection-Rules
3 rules| Detection | Severity | Format |
|---|---|---|
| List Defender Discovery Activities | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
| WMIC Antivirus Discovery | Undefined | KQL |
Wazuh Core Ruleset
2 rules| Detection | Severity | Format |
|---|---|---|
| WMI command was used for AV product discovery | High | Wazuh XML |
| Powershell tampering with WMI AntiVirusProduct class - Antivirus Software discovery | Medium | Wazuh XML |
elastic/protections-artifacts
2 rules| Detection | Severity | Format |
|---|---|---|
| Security Tooling Enumeration | Undefined | Elastic TOML |
| Suspicious Security Product Enumeration | Undefined | Elastic TOML |
panther-labs/panther-analysis
2 rules| Detection | Severity | Format |
|---|---|---|
| AppOmni Alert Passthrough | Medium | Panther Python |
| AWS Software Discovery | Informational | Panther Python |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Windows Software Discovery Via PowerShell | Undefined | SPL |