T1518 · Software Discovery

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1518 · Software Discovery · Sunturai

attack-patternenterprise-attackT1518

Software Discovery

attack-pattern--e3b6daca-e963-4a69-aee6-ed4fd653ad58

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.

Created: Sep 16, 2019, 5:52 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

2 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

18 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Delinea - Rare / first-seen event types	Unknown	Microsoft Sentinel analytics	Oct 7, 2026	MIT License
Enumeration Command Spawned via WMIPrvSE	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Yum/DNF Plugin Status Discovery	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious which Enumeration	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Polkit Version Discovery	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Pluggable Authentication Module (PAM) Version Discovery	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Kernel Module Enumeration	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
ESXI Discovery via Grep	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
ESXI Discovery via Find	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Tool Enumeration Detected via Defend for Containers	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS SSM Inventory Reconnaissance by Rare User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Security Software Discovery via Grep	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Snowflake - Multiple failed queries	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Windows Software Discovery Via PowerShell	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Detected Windows Software Discovery	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
HackTool - WinPwn Execution	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Detected Windows Software Discovery - PowerShell	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
HackTool - WinPwn Execution - ScriptBlock	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 18 of 18

Filter in the catalogue

External references

mitre-attackT1518Open reference

Platforms

ESXiIaaSLinuxmacOSWindows

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object