MITRE ATT&CKtechnique

T1518 Software Discovery

Published 2019-09-16 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
ESXi, IaaS, Linux, macOS, Windows
Version
1.5
Created
2019-09-16

Description

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · subtechnique of (2)

  • T1518.002 Backup Software Discovery sub-technique
  • T1518.001 Security Software Discovery sub-technique

Referenced by MITRE ATT&CK · uses (54)

  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9029 IronWind software (malware)
  • S9010 GlassWorm software (malware)
  • S1245 InvisibleFerret software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1228 PUBLOAD software (malware)
  • S1185 LightSpy software (malware)
  • S1183 StrelaStealer software (malware)
  • C0044 Juicy Mix campaign
  • S1153 Cuckoo Stealer software (malware)
  • S1148 Raccoon Stealer software (malware)
  • S1141 LunarWeb software (malware)
  • S1124 SocGholish software (malware)
  • S1099 Samurai software (malware)
  • G1017 Volt Typhoon group
  • S1065 Woody RAT software (malware)
  • S1064 SVCReady software (malware)
  • C0016 Operation Dust Storm campaign
  • C0014 Operation Wocao campaign
  • S1042 SUGARDUMP software (malware)
  • G1008 SideCopy group
  • S0674 CharmPower software (malware)
  • S0658 XCSSET software (malware)
  • S0652 MarkiRAT software (malware)
  • S0650 QakBot software (malware)
  • S0646 SpicyOmelette software (malware)
  • S0623 Siloscape software (malware)
  • S0598 P.A.S. Webshell software (malware)
  • G0129 Mustang Panda group
  • G0124 Windigo group
Show all 54 ›