{"id":"T1518","name":"Software Discovery","url":"https://attack.mitre.org/techniques/T1518","tactics":["discovery"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0392","stix_id":"x-mitre-detection-strategy--f18dee58-43be-41e4-85a3-c6820033ac0d","name":"Multi-Platform Software Discovery Behavior Chain","url":"https://attack.mitre.org/detectionstrategies/DET0392","analytics":[{"id":"AN1100","stix_id":"x-mitre-analytic--c0bbe0a5-680f-487b-8f5f-27703efb52b7","name":"Analytic 1100","description":"Adversary spawns a process or script to enumerate installed software using WMI, registry, or PowerShell, potentially followed by additional discovery or evasion behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0392#AN1100","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:PowerShell","channel":"Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"TimeWindow","description":"Detection may be scoped to multiple discovery commands within a short timeframe."},{"field":"ParentProcess","description":"Tuning based on whether discovery activity stems from suspicious versus approved management tools."}],"live":true,"detection_strategies":["DET0392"],"techniques":["T1518"]},{"id":"AN1101","stix_id":"x-mitre-analytic--c14042f6-5ebd-42a2-b293-b2367b300fb6","name":"Analytic 1101","description":"Adversary invokes 'dpkg -l', 'rpm -qa', or other package managers via shell or script to enumerate installed software.","url":"https://attack.mitre.org/detectionstrategies/DET0392#AN1101","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"Execution of dpkg, rpm, or other package manager with list flag","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:shell","channel":"Manual invocation of software enumeration commands via interactive shell","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-shell"}],"mutable_elements":[{"field":"ScriptName","description":"Path to the wrapper script that invokes enumeration commands."},{"field":"TTYContext","description":"Scope detection to interactive vs. background shell contexts."}],"live":true,"detection_strategies":["DET0392"],"techniques":["T1518"]},{"id":"AN1102","stix_id":"x-mitre-analytic--a1619e8f-10aa-46ab-8776-898e8c3d5b43","name":"Analytic 1102","description":"Adversary runs 'system_profiler SPApplicationsDataType' or queries plist files to enumerate software via Terminal or scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0392#AN1102","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Execution of system_profiler or osascript invoking enumeration","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"auditd:SYSCALL","channel":"Command line arguments including SPApplicationsDataType","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"AppScope","description":"Whether enumeration targets user apps or system apps."},{"field":"ProcessGroup","description":"Parent process or scripting environment (e.g., Python, osascript)."}],"live":true,"detection_strategies":["DET0392"],"techniques":["T1518"]},{"id":"AN1103","stix_id":"x-mitre-analytic--3ccd6662-c579-494f-bbfa-ffc3530e3db2","name":"Analytic 1103","description":"Adversary uses cloud-native APIs or CLI (e.g., AWS Systems Manager, Azure Resource Graph) to list installed software on cloud workloads.","url":"https://attack.mitre.org/detectionstrategies/DET0392#AN1103","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"ssm:ListInventoryEntries","data_component":"DC0083","data_component_name":"Cloud Service Enumeration","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"ssm:GetCommandInvocation","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"UserAgent","description":"Differentiate access from automated scripts vs. authorized console."},{"field":"InventoryType","description":"May focus on Application or Platform inventory only."}],"live":true,"detection_strategies":["DET0392"],"techniques":["T1518"]},{"id":"AN1104","stix_id":"x-mitre-analytic--0119786d-ee1e-4857-b31a-3a43830e28e7","name":"Analytic 1104","description":"Adversary uses 'esxcli software vib list' to enumerate installed VIBs, drivers, and modules.","url":"https://attack.mitre.org/detectionstrategies/DET0392#AN1104","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"esxcli software vib list","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"},{"name":"esxi:hostd","channel":"Host daemon command log entries related to vib enumeration","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"HostAccessMode","description":"Detection may vary based on whether enumeration is local or remote."},{"field":"ScriptChain","description":"Presence of enumeration in broader scripted sequence."}],"live":true,"detection_strategies":["DET0392"],"techniques":["T1518"]}],"live":true,"version":"1.0","techniques":["T1518"]}],"sigma_rules":[{"id":"2650dd1a-eb2a-412d-ac36-83f06c4f2282","title":"Detected Windows Software Discovery - PowerShell","author":"Nikita Nazarov, oscd.community","status":"test","level":"medium","date":"2020-10-16","modified":"2022-12-02","description":"Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md","https://github.com/harleyQu1nn/AggressorScripts"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1518"],"path":"rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml","techniques":["T1518"],"cves":[]},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"e13f668e-7f95-443d-98d2-1816a7648a7b","title":"Detected Windows Software Discovery","author":"Nikita Nazarov, oscd.community","status":"test","level":"medium","date":"2020-10-16","modified":"2022-10-09","description":"Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md","https://github.com/harleyQu1nn/AggressorScripts"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1518"],"path":"rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml","techniques":["T1518"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}