t1518-software-discovery

name	T1518_software-discovery
description	Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1518","discovery","esxi","iaas","linux","macos","windows"]
technique_id	T1518
tactic	discovery
all_tactics	["discovery"]
platforms	["ESXi","IaaS","Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1518
tech_stack	["esxi","cloud","linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	["T1518.001","T1518.002"]
prerequisites	[]
severity_boost	{"T1518.001":"Chain with T1518.001 for deeper attack path","T1518.002":"Chain with T1518.002 for deeper attack path"}

T1518 Software Discovery

High-Level Description

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally.

Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.

Kill Chain Phase

• Discovery (TA0007)

Platforms: ESXi, IaaS, Linux, macOS, Windows

What to Check

• Identify if Software Discovery technique is applicable to target environment
• Check ESXi systems for indicators of Software Discovery
• Check IaaS systems for indicators of Software Discovery
• Check Linux systems for indicators of Software Discovery
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Find and Display Internet Explorer Browser Version

Query the registry to determine the version of internet explorer installed on the system. Upon execution, version information about internet explorer will be displayed.

Supported Platforms: windows

reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer" /v svcVersion

Atomic Test 2: Applications Installed

Query the registry to determine software and versions installed on the system. Upon execution a table of software name and version information will be displayed.

Supported Platforms: windows

Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize
Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize