Loading interactive filters…

1200KM / simulation

T1518 Software Discovery — Attack Simulation

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security…

Complete technique description

Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally.

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.

Official technique definition · Open in the interactive matrix

Parent and sub-techniques

Related pages are navigation context. Their tools, rules and lab results are not automatically inherited.

Detection telemetry and configuration

These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.

Application Log Content · source-mapped

DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.

Providers and collection configuration

Application audit logs: First-party service events and request/result fields; schema is application-specific.
OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: service, action, actor, record_count, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0038",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "lab-portal",
    "action": "export_requested",
    "actor": "lab-reader",
    "record_count": 3,
    "result": "authorized"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

Cloud Service Enumeration · source-mapped

DC0083 collection page — Collect supported list/describe administrative APIs and retain caller and queried service scope; confirm read-event retention.

Providers and collection configuration

AWS CloudTrail: Management-plane API activity; supported resource/data events require separate selectors.
Azure Monitor Activity Log: Azure resource control-plane operations; resource data-plane logs are separate.
Google Cloud Audit Logs: Admin Activity and other categories; configure Data Access where required.

In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.

Required normalized fields: actor, service, action, result.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0083",
  "collector": "illustrative-lab-collector",
  "observation": {
    "actor": "lab-reader",
    "service": "lab-monitoring",
    "action": "list_resources",
    "result": "success"
  }
}

Visibility limits: AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.

Command Execution · source-mapped

DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.

Providers and collection configuration

PowerShell Script Block Logging: Script content via event 4104 when configured; channel depends on PowerShell edition.
Sysmon process events: Interpreter launch and parent context, not full script content.
Linux Audit: execve-family execution context; shell built-ins need additional instrumentation.

Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: interpreter, command_line, actor_uid, session_id.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0064",
  "collector": "illustrative-lab-collector",
  "observation": {
    "interpreter": "/bin/sh",
    "command_line": "printf LAB_TELEMETRY_CHECK",
    "actor_uid": 1000,
    "session_id": "lab-session-1"
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

Process Creation · source-mapped

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

Detection rules and analytic guidance

Open the dedicated detection workspace · Existing query engineering

DET0392 Multi-Platform Software Discovery Behavior Chain

MITRE detection strategy

AN1100 Analytic 1100

Adversary spawns a process or script to enumerate installed software using WMI, registry, or PowerShell, potentially followed by additional discovery or evasion behavior.

Platforms: Windows.

Process Creation — WinEventLog:Security; channel EventCode=4688.
Command Execution — WinEventLog:PowerShell; channel Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets.

AN1101 Analytic 1101

Adversary invokes 'dpkg -l', 'rpm -qa', or other package managers via shell or script to enumerate installed software.

Platforms: Linux.

Process Creation — auditd:SYSCALL; channel Execution of dpkg, rpm, or other package manager with list flag.
Command Execution — linux:shell; channel Manual invocation of software enumeration commands via interactive shell.

AN1102 Analytic 1102

Adversary runs 'system_profiler SPApplicationsDataType' or queries plist files to enumerate software via Terminal or scripts.

Platforms: macOS.

Process Creation — macos:unifiedlog; channel Execution of system_profiler or osascript invoking enumeration.
Command Execution — auditd:SYSCALL; channel Command line arguments including SPApplicationsDataType.

AN1103 Analytic 1103

Adversary uses cloud-native APIs or CLI (e.g., AWS Systems Manager, Azure Resource Graph) to list installed software on cloud workloads.

Platforms: IaaS.

Cloud Service Enumeration — AWS:CloudTrail; channel ssm:ListInventoryEntries.
Command Execution — AWS:CloudTrail; channel ssm:GetCommandInvocation.

AN1104 Analytic 1104

Adversary uses 'esxcli software vib list' to enumerate installed VIBs, drivers, and modules.

Platforms: ESXi.

Command Execution — esxi:shell; channel esxcli software vib list.
Application Log Content — esxi:hostd; channel Host daemon command log entries related to vib enumeration.

Source rule directory and observation requirements

4 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

HackTool - WinPwn Execution - ScriptBlock — test; category: ps_script; product: windows; definition: Requirements: Script Block Logging must be enabled.
Detected Windows Software Discovery - PowerShell — test; product: windows; category: ps_script; definition: Requirements: Script Block Logging must be enabled.
HackTool - WinPwn Execution — test; category: process_creation; product: windows.
Detected Windows Software Discovery — test; category: process_creation; product: windows.

T1518 Software Discovery

MATCH(command_or_api IN software_inventory_operations) AND caller NOT_IN approved_inventory_tools -> ALERT

Existing Atlas deterministic model · Pinned source

Before treating a rule as coverage

Read the actual condition and logsource; identify attacker-side, victim-side or third-party visibility.
Map native sensor fields, parse times and identities, then compile for the selected backend.
Replay a behavior-positive case, a normal control, an authorized look-alike and a missing-telemetry case.
Record matches and misses with rule version and source events. No match is inconclusive when required telemetry is absent.

Anomaly-based detection

No exact technique-specific Atlas model is present for T1518 in the selected source snapshot. The following is a design worksheet, not a newly validated model.

Anomaly engineering worksheet

Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.

Application and service audit: Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines.
Cloud control plane: Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity.
Script and command execution: Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility.
Endpoint activity: Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity.

Define an entity/peer group and feature; exclude the evaluation period from baseline training.
Use representative normal and maintenance activity. Do not invent a production threshold from a synthetic example.
Evaluate held-out behavior-positive and benign cases; measure false positives, misses and telemetry loss separately.
Keep abnormality separate from maliciousness. Correlate with the behavior-specific source evidence.

Anomaly Detection Atlas · Baseline, validation and blind spots

Attack tools and documented software

Cobalt Strike

ShimRatReporter

Software observed in source procedures

These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.

39 source-documented software associations

S0024 Dyre — malware.
Dyre has the ability to identify installed programs on a compromised host.[Malwarebytes Dyreza November 2015]
Exact relationship: relationship--e4489924-d87d-4a18-8702-418361f6a2bb
S0062 DustySky — malware.
DustySky lists all installed software for the infected machine.[Kaspersky MoleRATs April 2019]
Exact relationship: relationship--2b89f806-5b78-4599-9536-13b47c35d26d
S0126 ComRAT — malware.
ComRAT can check the victim's default browser to determine which process to inject its communications module into.[ESET ComRAT May 2020]
Exact relationship: relationship--31029adf-2b28-4d7f-bdd3-b07f55374eae
S0148 RTM — malware.
RTM can scan victim drives to look for specific banking software on the machine to determine next actions.[ESET RTM Feb 2017]
Exact relationship: relationship--f60ed279-c720-4906-9e63-3cd7ce49e1e0
S0154 Cobalt Strike — malware.
The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.[Cobalt Strike Manual 4.3 November 2020]
Exact relationship: relationship--3407bbe8-bceb-42f1-824b-d92d9972d917
S0229 Orz — malware.
Orz can gather the victim's Internet Explorer version.[Proofpoint Leviathan Oct 2017]
Exact relationship: relationship--70059c24-ccde-4832-854e-3bcb71c294a9
S0260 InvisiMole — malware.
InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.[ESET InvisiMole June 2018][ESET InvisiMole June 2020]
Exact relationship: relationship--af7ec7e9-08d2-4459-8c05-047185799058
S0384 Dridex — malware.
Dridex has collected a list of installed software on the system.[Checkpoint Dridex Jan 2021]
Exact relationship: relationship--41e8c16e-bfef-415f-b898-b76a1f527cc2
S0431 HotCroissant — malware.
HotCroissant can retrieve a list of applications from the <code>SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths</code> registry key.[Carbon Black HotCroissant April 2020]
Exact relationship: relationship--d07460c8-0d13-4c25-81f7-56e5198f07c5
S0445 ShimRatReporter — tool.
ShimRatReporter gathered a list of installed software on the infected host.[FOX-IT May 2016 Mofang]
Exact relationship: relationship--222ce94a-bb33-476b-b4c3-56b529d9af03
S0455 Metamorfo — malware.
Metamorfo has searched the compromised system for banking applications.[FireEye Metamorfo Apr 2018][ESET Casbaneiro Oct 2019]
Exact relationship: relationship--082b64f6-cc70-4bc8-a49f-bf0f125883f7
S0467 TajMahal — malware.
TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.[Kaspersky TajMahal April 2019]
Exact relationship: relationship--8455e704-68fd-4610-b63d-0d124a660802
S0472 down_new — malware.
down_new has the ability to gather information on installed applications.[Trend Micro Tick November 2019]
Exact relationship: relationship--c61ca699-62e8-4c42-b20c-3c042c0fb153
S0482 Bundlore — malware.
Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.[MacKeeper Bundlore Apr 2019]
Exact relationship: relationship--91038a74-575b-4f2e-9dba-767b50b8e4ab
S0526 KGH_SPY — malware.
KGH_SPY can collect information on installed applications.[Cybereason Kimsuky November 2020]
Exact relationship: relationship--dd4c57df-6ddc-4a41-b1ee-5f72556fc57d
S0534 Bazar — malware.
Bazar can query the Registry for installed applications.[Cybereason Bazar July 2020]
Exact relationship: relationship--794403a3-232e-4cc3-85e2-cc997825dfa8
S0598 P.A.S. Webshell — malware.
P.A.S. Webshell can list PHP server configuration details.[ANSSI Sandworm January 2021]
Exact relationship: relationship--87e99b39-e634-477e-b260-6098abc58dc2
S0623 Siloscape — malware.
Siloscape searches for the kubectl binary.[Unit 42 Siloscape Jun 2021]
Exact relationship: relationship--163851e2-5236-41cb-897f-06e33624c3ec
S0646 SpicyOmelette — malware.
SpicyOmelette can enumerate running software on a targeted system.[Secureworks GOLD KINGSWOOD September 2018]
Exact relationship: relationship--4859e904-e404-4bae-a106-d347c9cc2e18
S0650 QakBot — malware.
QakBot can enumerate a list of installed programs.[Group IB Ransomware September 2020]
Exact relationship: relationship--e342ee2b-d7b6-4a48-a689-06a68efe589e
S0652 MarkiRAT — malware.
MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.[Kaspersky Ferocious Kitten Jun 2021]
Exact relationship: relationship--d1a2cd6c-1c7b-4c1a-9416-106e7951642c
S0658 XCSSET — malware.
XCSSET uses <code>ps aux</code> with the <code>grep</code> command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.[trendmicro xcsset xcode project 2020]
Exact relationship: relationship--0ecc1e3a-340a-42b6-9739-c6a243ffaa8f
S0674 CharmPower — malware.
CharmPower can list the installed applications on a compromised host.[Check Point APT35 CharmPower January 2022]
Exact relationship: relationship--17317bb7-40a1-47a0-8200-c89df3a339b2
S1042 SUGARDUMP — malware.
SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.[Mandiant UNC3890 Aug 2022]
Exact relationship: relationship--2f8394e6-2cf2-473a-b60a-6de2e69c39c8
S1064 SVCReady — malware.
SVCReady can collect a list of installed software from an infected host.[HP SVCReady Jun 2022]
Exact relationship: relationship--d066c8bf-591c-4923-8794-5336cd568ab2
S1065 Woody RAT — malware.
Woody RAT can collect .NET, PowerShell, and Python information from an infected host.[MalwareBytes WoodyRAT Aug 2022]
Exact relationship: relationship--f372cb23-0736-4cbb-8ba0-3388599226f9
S1099 Samurai — malware.
Samurai can check for the presence and version of the .NET framework.[Kaspersky ToddyCat June 2022]
Exact relationship: relationship--ff6c2e20-53c1-4840-8bc6-e404e627ad82
S1124 SocGholish — malware.
SocGholish can identify the victim's browser in order to serve the correct fake update page.[Secureworks Gold Prelude Profile]
Exact relationship: relationship--b78b92b1-deab-4ac1-b1c5-ceb6fa28810a
S1141 LunarWeb — malware.
LunarWeb can list installed software on compromised systems.[ESET Turla Lunar toolset May 2024]
Exact relationship: relationship--45e1151f-d4f7-478a-8bb5-78e4698a8a06
S1148 Raccoon Stealer — malware.
Raccoon Stealer is capable of identifying running software on victim machines.[Sekoia Raccoon1 2022][Sekoia Raccoon2 2022]
Exact relationship: relationship--c9767024-ff9a-4c20-b29c-5270874f8cd1
S1153 Cuckoo Stealer — malware.
Cuckoo Stealer has the ability to search systems for installed applications.[Kandji Cuckoo April 2024]
Exact relationship: relationship--2cfb6d2b-5a32-4ff9-9eb8-83a051eaff0d
S1183 StrelaStealer — malware.
StrelaStealer variants use COM objects to enumerate installed applications from the "AppsFolder" on victim machines.[IBM StrelaStealer 2024]
Exact relationship: relationship--5166f101-8d87-4967-bc3c-5f6ee97b863c
S1185 LightSpy — malware.
If sent the command `16001`, LightSpy uses the `NSFileManger contentsOfDirectoryAtPath()` to enumerate the Applications folder to collect the bundle name, bundle identifier, and version information from each application's `info.plist` file. The results are then converted into a JSON blob for exfiltration.[Huntress LightSpy macOS 2024]
Exact relationship: relationship--bad8e857-fe92-49d3-8bd7-50a6665c0902
S1228 PUBLOAD — malware.
PUBLOAD has used several commands executed in sequence via `cmd` in a short interval to gather software versions including querying Registry keys.[Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024]
Exact relationship: relationship--a6fd818c-d0a6-44ca-b80d-abb80af9acac
S1240 RedLine Stealer — malware.
RedLine Stealer can get a list of programs on the victim device.[Splunk RedLine Stealer June 2023]
Exact relationship: relationship--ea245e90-c14f-457c-998f-04c431dcc458
S1245 InvisibleFerret — malware.
InvisibleFerret has gathered installed programs and running processes.[Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024]
Exact relationship: relationship--61387ea8-b511-4a66-9d99-c89a72017476
S9010 GlassWorm — malware.
GlassWorm has searched for existing wallet applications to include Ledger Live and Trezor Suite.[Koi Glassworm New Tricks December 2025]
Exact relationship: relationship--cb72e7c8-23a4-40d8-916e-99a18db9039c
S9029 IronWind — malware.
IronWind can list installed software on targeted hosts.[Check Point Wirte NOV 2024]
Exact relationship: relationship--c78ed1f7-5a62-4153-8230-df01164232f4
S9041 TeamPCP Cloud Stealer — malware.
TeamPCP Cloud Stealer has searched for cryptocurrency wallets on targeted hosts.[Wiz Trivy Compromise MAR 2026][Aqua Security Trivy Compromise MAR 2026]
Exact relationship: relationship--53e1f658-489e-41ac-849a-335998544cf5

Simulation design and documented procedures

Atomic evidence: 6 compatible documented candidates. Live lab status: not run for these imported procedures.

Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.

WinPwn - powerSQL

Start PowerUpSQL Checks using powerSQL function of WinPwn

Pinned Atomic procedure · 0bb64470-582a-4155-bde2-d6003a95ed34 · windows · powershell.