Backup Software Discovery (T1518.002) is a Discovery technique. Adversaries look for the backup software or configurations on a system. MITRE lists Windows, macOS and Linux.
How attackers use it
MITRE says the information shapes follow on behavior such as Data Destruction, Inhibit System Recovery or Data Encrypted for Impact. Finding backup products first lets an attacker work out what must be disabled to stop you recovering. MITRE lists commands such as netsh, reg query with Reg, dir with cmd and Tasklist, aimed at products like Veeam, Acronis, Dropbox or Paragon.
How to detect it
MITRE's analytics describe:
- Windows: commands such as tasklist, sc query, reg query or PowerShell WMI and registry queries aimed at known backup products, often with PowerShell or cmd.exe as parent, and enumeration of services, folders or registry paths for backup software.
- Linux: tools such as find, grep, ls, dpkg, rpm, systemctl and ps aux used to find backup agents or configuration, often searching /etc, /opt or /var for the word backup.
- macOS: mdfind, launchctl or GUI enumeration with find, grep or system_profiler to identify tools like Time Machine, Carbon Copy Cloner or Backblaze.
Raise the priority of any alert like this that is followed by service stops or deletion of backup data, since that sequence points toward ransomware preparation.
How to reduce the risk
MITRE lists no mitigations for this technique. Protect the backups themselves: keep an offline or immutable copy, limit who can reach backup consoles, and test restores regularly so a loss of the online copy is survivable.
Quick check
Why watch for this step during an intrusion?
It often comes before actions that destroy or block recovery, such as Inhibit System Recovery or Data Encrypted for Impact, so it can be an early warning.
