Software Discovery (T1518) is a Discovery technique. Adversaries try to get a list of the software and versions installed on a system or in a cloud environment. MITRE lists ESXi, IaaS, Linux, macOS and Windows.
How attackers use it
The list shapes what comes next. MITRE says the information can decide whether an adversary fully infects a target or tries specific actions. It can show which security measures are present, or whether the machine runs a version of software vulnerable to Exploitation for Privilege Escalation. MITRE also points out that management or security software deployed widely, such as Software Deployment Tools, can give an adversary broad access to infect other devices or move laterally.
How to detect it
MITRE's detection strategy is a chain of behavior, by platform:
- Windows: a process or script that enumerates installed software through WMI, the registry or PowerShell, possibly followed by more discovery or evasion.
- Linux: dpkg -l, rpm -qa or other package managers run from a shell or script.
- macOS: system_profiler SPApplicationsDataType, or queries of plist files, from Terminal or scripts.
- Cloud: cloud native APIs or CLIs, such as AWS Systems Manager or Azure Resource Graph, used to list software on workloads.
- ESXi: esxcli software vib list to enumerate VIBs, drivers and modules.
Each command is normal for an administrator, so context decides. Look at who ran it, from what parent process and whether it came right after a new logon or a suspicious download.
How to reduce the risk
MITRE lists no mitigations for this technique, since it abuses legitimate system features. Focus on detection and on removing the payoff: if the software list shows nothing vulnerable, the attacker learns less.
For that, you need your own inventory of installed software and dependencies. The free in-browser scan at gold.safeguard.sh/scan needs no login, the file never leaves your machine, and it handles up to 100 dependencies.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is a single dpkg or rpm query not an alert by itself?
Administrators run these all the time. Parent process, user, timing and what happens next make the difference.
