T1518 Software Discovery

Technique

T1518

Tactics

Discovery

Research, 90 days

6

KEV CVEs mapped

0

SigmaHQ rules

4

Elastic, Splunk

16

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1518

MITRE description

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072), and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
• 2026-10-08 Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
• 2026-10-02 Group-IB: Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino
• 2026-08-31 Group-IB: Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem
• 2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

• HackTool - WinPwn Execution - ScriptBlock (core)
• Detected Windows Software Discovery - PowerShell (core)
• HackTool - WinPwn Execution (core)
• Detected Windows Software Discovery (core)

Elastic and Splunk rules

• Security Software Discovery via Grep (elastic)
• AWS SSM Inventory Reconnaissance by Rare User (elastic)
• Tool Enumeration Detected via Defend for Containers (elastic)
• ESXI Discovery via Find (elastic)
• ESXI Discovery via Grep (elastic)
• Unusual Kernel Module Enumeration (elastic)
• Pluggable Authentication Module (PAM) Version Discovery (elastic)
• Polkit Version Discovery (elastic)
• Suspicious which Enumeration (elastic)
• Yum/DNF Plugin Status Discovery (elastic)
• Enumeration Command Spawned via WMIPrvSE (elastic)
• Enumeration of Kernel Modules via Proc (elastic)
• Deprecated - PowerShell Script with Discovery Capabilities (elastic)
• Process Discovery via Built-In Applications (elastic)
• Security Software Discovery using WMIC (elastic)
• Windows Software Discovery Via PowerShell (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.