{ "technique_id": "T1518", "name": "Software Discovery", "priority": "high", "status": "draft", "version": "0.1.0", "last_reviewed": "2026-07-23", "generated_by": "SOC Response Atlas by Basyrix", "tactics": [ "Discovery" ], "platforms": [ "ESXi", "IaaS", "Linux", "macOS", "Windows" ], "summary": "Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions...", "soc_recommendation": "Investigate Software Discovery activity in the context of Discovery: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.", "d3fend_mappings": [ { "id": "D3-SCA", "name": "System Call Analysis", "relationship": "detect", "practical_action": "Monitor for System Call Analysis indicators relevant to this technique.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-SCF", "name": "System Call Filtering", "relationship": "isolate", "practical_action": "Apply System Call Filtering to contain the blast radius once this technique is observed.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-RC", "name": "Restore Configuration", "relationship": "restore", "practical_action": "Use Restore Configuration to recover affected systems or data after containment.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-CI", "name": "Configuration Inventory", "relationship": "model", "practical_action": "Use Configuration Inventory to establish a baseline that makes this technique's deviations easier to spot.", "tooling": [ "Defender for Endpoint" ] } ], "investigation_steps": { "microsoft": [ "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.", "Check Sentinel analytics rules and incidents correlated with this technique.", "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource." ], "generic": [ "Confirm whether the observed software discovery activity matches expected administrative or application behaviour.", "Identify the host, account, or resource where the activity occurred and its business criticality.", "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.", "Real detection reference: \"Snowflake - Multiple failed queries\" -- Detects multiple failed queries in short timeframe.'" ] }, "evidence_to_collect": [ "Host or resource affected", "Account or identity involved", "Timestamp of the activity", "Related process, file, or network artifact", "Any preceding or follow-on alerts" ], "response_actions": [ { "name": "Contain the affected host or account", "category": "Containment", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "Defender for Endpoint / Entra ID", "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account." }, { "name": "Collect and preserve evidence", "category": "Investigation", "risk": "Low", "automation_safe": true, "approval_required": false, "tool": "Defender for Endpoint", "notes": "Safe -- read-only evidence collection." } ], "queries": { "kql": [ { "name": "5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8 — Snowflake - Multiple failed queries", "description": "Detects multiple failed queries in short timeframe.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "let threshold = 50;\nSnowflake\n| where isnotempty(QueryExecutionStatus)\n| where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" }, { "name": "ef88eb96-861c-43a0-ab16-f3835a97c928 — Powershell Empire Cmdlets Executed in Command Line", "description": "This query identifies use of PowerShell Empire's cmdlets within the command line data of the PowerShell process, indicating potential use of the post-exploitation tool.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1518.001.)", "query": "let regexEmpire = tostring(toscalar(externaldata(cmdlets:string)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/EmpireCommandString.txt\"] with (format=\"txt\")));\n(union isfuzzy=true\n (SecurityEvent\n| where EventID == 4688\n//consider filtering on filename if perf issues occur\n//where FileName in~ (\"powershell.exe\",\"powershell_ise.exe\",\"pwsh.exe\")\n| where not(ParentProcessName has_any ('gc_worker.exe', 'gc_service.exe'))\n| where CommandLine has \"-encodedCommand\"\n| parse kind=regex flags=i CommandLine with * \"-EncodedCommand \" encodedCommand\n| extend encodedCommand = iff(encodedCommand has \" \", tostring(split(encodedCommand, \" \")[0]), encodedCommand)\n// Note: currently the base64_decode_tostring function is limited to supporting UTF8\n| extend decodedCommand = translate('\\0','', base64_decode_tostring(substring(encodedCommand, 0, strlen(encodedCommand) - (strlen(encodedCommand) %8)))), encodedCommand, CommandLine , strlen(encodedCommand)\n| extend EfectiveCommand = iff(isnotempty(encodedCommand), decodedCommand, CommandLine)\n| where EfectiveCommand matches regex regexEmpire\n| project timestamp = TimeGenerated, Computer, SubjectUserName, SubjectDomainName, FileName = Process, EfectiveCommand, decodedCommand, encodedCommand, CommandLine, ParentProcessName\n| extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')\n),\n(WindowsEvent\n| where EventID == 4688\n| where EventData has_any (\"-encodedCommand\", \"powershell.exe\",\"powershell_ise.exe\",\"pwsh.exe\")\n| where not(EventData has_any ('gc_worker.exe', 'gc_service.exe'))\n//consider filtering on filename if perf issues occur\n//extend NewProcessName = tostring(EventData.NewProcessName)\n//extend Process=tostring(split(NewProcessName, '\\\\')[-1])\n//FileName = Process\n//where FileName in~ (\"powershell.exe\",\"powershell_ise.exe\",\"pwsh.exe\")\n| extend ParentProcessName = tostring(EventData.ParentProcessName)\n| where not(ParentProcessName has_any ('gc_worker.exe', 'gc_service.exe'))\n| extend CommandLine = tostring(EventData.CommandLine)\n| where CommandLine has \"-encodedCommand\"\n| parse kind=regex flags=i CommandLine with * \"-EncodedCommand \" encodedCommand\n| extend encodedCommand = iff(encodedCommand has \" \", tostring(split(encodedCommand, \" \")[0]), encodedCommand)\n// Note: currently the base64_decode_tostring function is limited to supporting UTF8\n| extend decodedCommand = translate('\\0','', base64_decode_tostring(substring(encodedCommand, 0, strlen(encodedCommand) - (strlen(encodedCommand) %8)))), encodedCommand, CommandLine , strlen(encodedCommand)\n| extend EfectiveCommand = iff(isnotempty(encodedCommand), decodedCommand, CommandLine)\n| where EfectiveCommand matches regex regexEmpire\n| extend SubjectUserName = tostring(EventData.SubjectUserName)\n| extend SubjectDomainName = tostring(EventData.SubjectDomainName)\n| extend NewProcessName = tostring(EventData.NewProcessName)\n| extend Process=tostring(split(NewProcessName, '\\\\')[-1])\n| project timestamp = TimeGenerated, Computer, SubjectUserName, SubjectDomainName, FileName = Process, EfectiveCommand, decodedCommand, encodedCommand, CommandLine, ParentProcessName\n| extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')\n))" } ], "spl": [], "esql": [ { "name": "870aecc0-cea4-4110-af3f-e02e9b373655 — Security Software Discovery via Grep", "description": "(EQL) Identifies the use of the grep command to discover known third-party macOS and Linux security tools, such as Antivirus or Host Firewall details. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "process where event.type == \"start\" and\nprocess.name : (\"grep\", \"egrep\", \"pgrep\") and user.id != \"0\" and\n not process.parent.executable : (\"/Library/Application Support/*\", \"/opt/McAfee/agent/scripts/ma\") and\n process.args :\n (\"Little Snitch*\",\n \"Avast*\",\n \"Avira*\",\n \"ESET*\",\n \"BlockBlock*\",\n \"360Sec*\",\n \"LuLu*\",\n \"KnockKnock*\",\n \"kav\",\n \"KIS\",\n \"RTProtectionDaemon*\",\n \"Malware*\",\n \"VShieldScanner*\",\n \"WebProtection*\",\n \"webinspectord*\",\n \"McAfee*\",\n \"isecespd*\",\n \"macmnsvc*\",\n \"masvc*\",\n \"kesl*\",\n \"avscan*\",\n \"guard*\",\n \"rtvscand*\",\n \"symcfgd*\",\n \"scmdaemon*\",\n \"symantec*\",\n \"sophos*\",\n \"osquery*\",\n \"elastic-endpoint*\",\n \"falcond*\",\n \"SentinelOne*\",\n \"CbOsxSensorService*\",\n \"CbDefense*\",\n \"WhatsYourSign*\",\n \"reikey*\",\n \"OverSight*\",\n \"KextViewr*\",\n \"Netiquette*\",\n \"processmonitor*\",\n \"filemonitor*\"\n ) and\n not (\n (process.args : \"Avast\" and process.args : \"Passwords\") or\n (process.args == \"osquery.conf\") or \n (process.parent.args : \"/opt/McAfee/agent/scripts/ma\" and process.parent.args : \"checkhealth\") or\n (process.command_line : (\n \"grep ESET Command-line scanner, version %s -A2\",\n \"grep -i McAfee Web Gateway Core version:\",\n \"grep --color=auto ESET Command-line scanner, version %s -A2\"\n )\n ) or\n (process.parent.command_line : (\n \"\"\"sh -c printf \"command_start_%s\"*; perl -pe 's/[^ -~]/\\n/g' < /opt/eset/esets/sbin/esets_scan | grep 'ESET Command-line scanner, version %s' -A2 | tail -1; printf \"command_done_%s*\"\"\",\n \"\"\"bash -c perl -pe 's/[^ -~]/\\n/g' < /opt/eset/esets/sbin/esets_scan | grep 'ESET Command-line scanner, version %s' -A2 | tail -1\"\"\"\n )\n )\n )" }, { "name": "33a6752b-da5e-45f8-b13a-5f094c09522f — ESXI Discovery via Find", "description": "(EQL) Identifies instances where the 'find' command is started on a Linux system with arguments targeting specific VM-related paths, such as \"/etc/vmware/\", \"/usr/lib/vmware/\", or \"/vmfs/*\"... (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nevent.action in (\"exec\", \"exec_event\", \"start\", \"executed\", \"process_started\", \"ProcessRollup2\") and\nprocess.name == \"find\" and process.args like (\"/etc/vmware/*\", \"/usr/lib/vmware/*\", \"/vmfs/*\") and\nnot ?process.parent.executable == \"/usr/lib/vmware/viewagent/bin/uninstall_viewagent.sh\"" } ] }, "automation": { "safe": [ "Add recommendation as Sentinel incident comment.", "Run enrichment queries.", "Create ServiceNow SecOps task." ], "approval_required": [ "Contain or disable the affected host/account.", "Any change to production configuration." ] }, "escalation_criteria": [ "Software Discovery activity observed on a privileged account or critical system.", "Activity follows or precedes other suspicious behaviour in the same investigation.", "Automated triage cannot confidently rule out malicious intent." ], "false_positive_considerations": [ "Legitimate administrative or maintenance activity matching this pattern.", "Approved security testing or red team exercise.", "Known benign software producing similar telemetry." ], "confluence": { "title": "T1518 - Software Discovery Response Guidance", "labels": [ "mitre", "attack", "d3fend", "secops", "basyrix" ], "sections": [ "summary", "d3fend_mappings", "investigation_steps", "response_actions", "queries", "automation", "escalation_criteria", "false_positive_considerations" ] } }