Volt TyphoonG1017 ↗
Has queried the Registry on compromised systems for information on installed software.12
tfMITRE ATT&CK technique
Software Discovery T1518
- Tactic
- Discovery
- Platforms
- ESXi, IaaS, Linux, macOS, Windows
- Version
- 1.5
- Created
- 16 September 2019
- Last modified
- 12 May 2026
Sub-techniques 214 rules across the family · 5 mapped directly to T1518 · 1 of 2 carry rules
Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
11
Threat groupsTop 17%
Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.39
Tools & malwareTop 10%
Tools & malware90th percentile · 90% of ATT&CK techniques have this many tools implementing them or fewer.5
Detection rules64th pct
Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.Software Discovery MITRE reference T1518
Top 17%of all ATT&CK techniques for number of groups
11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
SideCopyG1008 ↗
Has collected browser information from a compromised host.1
Mustang PandaG0129 ↗
Has searched the victim system for the InstallUtil.exe program and its version.1
WindigoG0124 ↗
Has used a script to detect installed software on targeted systems.1
SidewinderG0121 ↗
Has used tools to enumerate software installed on an infected host.12
WindshiftG0112 ↗
Has used malware to identify installed software.1
All 11 groups for this technique · 6 newest in this preview
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Juicy MixC0044 ↗
During Juicy Mix, OilRig used browser data dumper tools to create a list of users with Google Chrome installed.1
Operation WocaoC0014 ↗
During Operation Wocao, threat actors collected a list of installed software on the infected system.1
Operation Dust StormC0016 ↗
During Operation Dust Storm, the threat actors deployed a file called DeployJava.js to fingerprint installed software on a victim system prior to exploit delivery.1
All 3 campaigns for this technique
39 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TeamPCP Cloud StealerS9041 ↗
Has searched for cryptocurrency wallets on targeted hosts.12
IronWindS9029 ↗
Can list installed software on targeted hosts.1
GlassWormS9010 ↗
Has searched for existing wallet applications to include Ledger Live and Trezor Suite.1
InvisibleFerretS1245 ↗
Has gathered installed programs and running processes.1
RedLine StealerS1240 ↗
Can get a list of programs on the victim device.1
PUBLOADS1228 ↗
Has used several commands executed in sequence via cmd in a short interval to gather software versions including querying Registry keys.1
All 39 software entries for this technique · 6 newest in this preview
Offense vs defense T1518
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 1
first rule: 2020 Q4 · 2 of 3 campaigns plotted (Operation Dust Storm (dated 2010) falls before the 2017 window)Software Discovery detection strategy DET0392
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Multi-Platform Software Discovery Behavior Chain
5 platforms
AN1100 · Windows
Adversary spawns a process or script to enumerate installed software using WMI, registry, or PowerShell, potentially followed by additional discovery or evasion behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Detection may be scoped to multiple discovery commands within a short timeframe. |
| ParentProcess | Tuning based on whether discovery activity stems from suspicious versus approved management tools. |
AN1101 · Linux
Adversary invokes 'dpkg -l', 'rpm -qa', or other package managers via shell or script to enumerate installed software.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | Execution of dpkg, rpm, or other package manager with list flag |
| Command ExecutionDC0064 | linux:shell | Manual invocation of software enumeration commands via interactive shell |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ScriptName | Path to the wrapper script that invokes enumeration commands. |
| TTYContext | Scope detection to interactive vs. background shell contexts. |
AN1102 · macOS
Adversary runs 'system_profiler SPApplicationsDataType' or queries plist files to enumerate software via Terminal or scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Execution of system_profiler or osascript invoking enumeration |
| Command ExecutionDC0064 | auditd:SYSCALL | Command line arguments including SPApplicationsDataType |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AppScope | Whether enumeration targets user apps or system apps. |
| ProcessGroup | Parent process or scripting environment (e.g., Python, osascript). |
AN1103 · IaaS
Adversary uses cloud-native APIs or CLI (e.g., AWS Systems Manager, Azure Resource Graph) to list installed software on cloud workloads.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | AWS:CloudTrail | ssm:GetCommandInvocation |
| Cloud Service EnumerationDC0083 | AWS:CloudTrail | ssm:ListInventoryEntries |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserAgent | Differentiate access from automated scripts vs. authorized console. |
| InventoryType | May focus on Application or Platform inventory only. |
AN1104 · ESXi
Adversary uses 'esxcli software vib list' to enumerate installed VIBs, drivers, and modules.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | esxi:hostd | Host daemon command log entries related to vib enumeration |
| Command ExecutionDC0064 | esxi:shell | esxcli software vib list |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| HostAccessMode | Detection may vary based on whether enumeration is local or remote. |
| ScriptChain | Presence of enumeration in broader scripted sequence. |
Tests6ExecutorsPowerShell 4 · cmd 1 · sh 1Need elevation0 of 6Have prerequisites0Have cleanup0Platformswindows, macos
Tests from Atomic Red Team (MIT licence) · technique definition