Wizard SpiderG0102 ↗
Has utilized the PowerShell script Get-DataInfo.ps1 to collect installed backup software information from a compromised machine.1
tfMITRE ATT&CK sub-technique
Backup Software Discovery T1518.002
sub-technique of T1518 Software Discovery
- Tactic
- Discovery
- Platforms
- Windows, macOS, Linux
- Version
- 1.0
- Created
- 22 May 2025
- Last modified
- 22 October 2025
- Contributor
- Florian Heigl
Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as Data Destruction, Inhibit System Recovery, or Data Encrypted for Impact.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Backup Software Discovery MITRE reference T1518.002
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
Offense vs defense T1518.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Backup Software Discovery detection strategy DET0088
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Backup Software Discovery via CLI, Registry, and Process Inspection (T1518.002)
3 platforms
AN0240 · Windows
Defender observes execution of commands like tasklist, sc query, reg query, or PowerShell WMI/Registry queries targeting known backup products (e.g., Veeam, Acronis, CrashPlan). Behavior often includes parent-child lineage involving PowerShell or cmd.exe with discovery syntax, and enumeration of services, directories, or registry paths tied to backup software.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| KnownBackupVendors | List of software vendors to match in command-line or registry queries |
| UserContextScope | Focus on low-privilege or interactive user contexts rather than service accounts |
| SuspiciousParentProcesses | Flag execution from scripting tools, interpreters, or LOLBins |
AN0241 · Linux
Defender observes use of CLI tools (find, grep, ls, dpkg, rpm, systemctl, ps aux) to discover backup agents or config files (e.g., rsnapshot, duplicity, veeam). This often includes command lines that recursively search /etc/, /opt/, or /var/ directories for keywords like backup, and parent-child relationships involving shell or Python scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve: Execution of discovery commands targeting backup binaries, processes, or config paths |
| File AccessDC0055 | auditd:PATH | Read access to known backup software configuration files (e.g., /etc/rsnapshot.conf, /opt/veeam/config.ini) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BackupConfigPaths | Directory paths and filenames related to backup agents |
| ToolchainScope | Shells, interpreters, or binaries used by attacker scripts for discovery |
AN0242 · macOS
Defender detects execution of mdfind, launchctl, or GUI-based enumeration (e.g., /Applications/Time Machine.app) along with command-line usage of find, grep, or system_profiler to identify installed backup tools like Time Machine, Carbon Copy Cloner, or Backblaze. Often triggered from Terminal sessions or within post-exploitation scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Process execution logs showing discovery commands like mdfind, system_profiler, or launchctl list |
| File AccessDC0055 | macos:unifiedlog | Read access to Time Machine plist files or CCC configurations in ~/Library/Preferences/ |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| InstallLocationScope | Directories or bundles where backup tools are commonly installed |
| KnownAppPlistPaths | Plist files related to backup software configurations |