{"id":"e13f668e-7f95-443d-98d2-1816a7648a7b","title":"Detected Windows Software Discovery","description":"Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.","author":"Nikita Nazarov, oscd.community","status":"test","level":"medium","date":"2020-10-16","modified":"2022-10-09","tags":["attack.discovery","attack.t1518"],"technique_ids":["T1518"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administration activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md","https://github.com/harleyQu1nn/AggressorScripts"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml","source_sha256":"97d9492bf9ffc8f33a9a9c215d3689ba5aadabce9076fabfe39844c15439ea81","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Detected Windows Software Discovery\nid: e13f668e-7f95-443d-98d2-1816a7648a7b\nrelated:\n    - id: 2650dd1a-eb2a-412d-ac36-83f06c4f2282\n      type: derived\nstatus: test\ndescription: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md\n    - https://github.com/harleyQu1nn/AggressorScripts # AVQuery.cna\nauthor: Nikita Nazarov, oscd.community\ndate: 2020-10-16\nmodified: 2022-10-09\ntags:\n    - attack.discovery\n    - attack.t1518\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\reg.exe'    # Example: reg query \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\" /v svcVersion\n        CommandLine|contains|all:\n            - 'query'\n            - '\\software\\'\n            - '/v'\n            - 'svcversion'\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1518","id":"T1518","name":"Software Discovery","page":"techniques/enterprise/T1518/"}],"data_path":"data/detection-rules/e13f668e-7f95-443d-98d2-1816a7648a7b.json","kind":"sigma"}