MITRE D3FENDdefensive technique

D3-SWI Software Inventory

Official page ↗
Tactic
Model
Synonyms
Software Discovery, Software Inventorying

Definition

Software inventorying identifies and records the software items in the organization's architecture.

How it works

How it works Administrators collect information on software items in their architecture using a variety of administrative and management tools that query network nodes for information. In limited cases, where such queries are not supported or provide specific information of interest, an administrator may also collect this information through network enumeration methods to determine services responding on network nodes. Considerations • Scanning and probing techniques using mapping tools can result in side effects to information technology (IT) and operational technology (OT) systems. • An adversary conducting network enumeration may engage in activities that parallel normal software inventorying activities, but would require escalating to admin privileges for most of the operations requiting administrative tools. Examples Application-layer discovery: • Simple Network Management Protocol (SNMP) collects MIB information • Web-based Enterprise Management (WBEM) collects CIM information • Windows Management Instrumentation (WMI) • Windows Management Infrastructure (MI)

Related

Counters · MITRE ATT&CK (46)

  • T0894 System Binary Proxy Execution technique
  • T1649 Steal or Forge Authentication Certificates technique
  • T1218.014 MMC sub-technique
  • T1505.004 IIS Components sub-technique
  • T0889 Modify Program technique
  • T1542.004 ROMMONkit sub-technique
  • T1564.006 Run Virtual Instance sub-technique
  • T0811 Data from Information Repositories technique
  • T0817 Drive-by Compromise technique
  • T0843 Program Download technique
  • T0845 Program Upload technique
  • T0851 Rootkit technique
  • T0873 Project File Infection technique
  • T1127.001 MSBuild sub-technique
  • T1574.005 Executable Installer File Permissions Weakness sub-technique
  • T1574 Hijack Execution Flow technique
  • T1574.010 Services File Permissions Weakness sub-technique
  • T1195.001 Compromise Software Dependencies and Development Tools sub-technique
  • T1195.002 Compromise Software Supply Chain sub-technique
  • T1497.003 Time Based Checks sub-technique
  • T1564 Hide Artifacts technique
  • T1056.003 Web Portal Capture sub-technique
  • T1554 Compromise Host Software Binary technique
  • T1546.011 Application Shimming sub-technique
  • T1547.008 LSASS Driver sub-technique
  • T1547 Boot or Logon Autostart Execution technique
  • T1546 Event Triggered Execution technique
  • T1542.001 System Firmware sub-technique
  • T1542.002 Component Firmware sub-technique
  • T1542.003 Bootkit sub-technique
Show all 46 ›

Child of · MITRE D3FEND (1)

  • D3-AI Asset Inventory defensive technique

References