Forensia CTI Core

About

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.

Platforms: ESXi, IaaS, Linux, macOS, WindowsMITRE ATT&CK ↗

Used by actors

11 known groups

G0060 BRONZE BUTLER G0069 MuddyWater G0081 Tropic Trooper G0100 Inception G0112 Windshift G0121 Sidewinder G0124 Windigo G0129 Mustang Panda G1001 HEXANE G1008 SideCopy G1017 Volt Typhoon

Software

38 malware/tools implement this

DyreDustySkyComRATRTMCobalt StrikeOrzInvisiMoleDridexHotCroissantShimRatReporterMetamorfoTajMahaldown_newBundloreKGH_SPYBazarP.A.S. WebshellSiloscapeSpicyOmeletteQakBotMarkiRATXCSSETCharmPowerSUGARDUMPSVCReadyWoody RATSamuraiSocGholishLunarWebRaccoon StealerCuckoo StealerStrelaStealerLightSpyPUBLOADRedLine StealerInvisibleFerretGlassWormIronWind

Corpus indicators tagged with this technique

200 indicators in the corpus carry T1518.

Indicator	Type	Family	Sev	Src
307964ed02f34bff4e40c5402cc936be07fd9957ef400596a4b3e2cd98c50ec1	sha256	—	80	1
92710bdb44279dbe8ccff34ba698d1558fa6d271c99ed4960ccbfb6d518d9418	sha256	—	80	1
2267d05dbd5e30c6dfcdde25731280dd755e689faa684bd21cfbef5281fd3e86	sha256	—	80	1
2d8e5a2763f9a899fda44390d5b8495836c11fb266a61868d52d1f397c5243ee	sha256	—	80	1
7a370a9262d37de6a24706f92ff0cdded7202281a6ff3bf313721756226ebff9	sha256	—	80	1
8bef879c6920cdce7c01b8dbb7da24dca23b8822a7aa00dfc72cb32f55879a24	sha256	—	80	1
19e0070e5009bd5b376b9be997361d0773dcb004200ee8fafe6c14b96cbd93e4	sha256	—	80	1
1d52ded1f3838a1eee849ae20b2fee6c84b183cc98abe7244365b9f34b925eea	sha256	—	80	1
ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736	sha256	—	80	1
2d5615acd1b0666995fd124fb72f2713c6609b5368350340288b52fecbdd016d	sha256	—	80	1
4e035575be8fe350a9e36cf29dbbc8826af2f772672bd08c9e489a243cb90e31	sha256	—	80	1
57edeb575862ce8d3bff2eb4d32d9e3fa1ffb7cb8f818e2e7fc6d25a506faea6	sha256	—	80	1
848036661c71b80ee41566918faa5eae3bf4f03ae807bb4af42cb483b6c141e2	sha256	—	80	1
88f9e169a85dcf6a1c03bf3ca1b1a262ed32baeca46cb87f0324adfdc098d4a2	sha256	—	80	1
7d8b6a64f7b65b281e7b5568929c6f96c62bbae9628162aabe7d8140a86d3de8	sha256	—	80	1
12b41c07299d2535f7cdc194d97496acd944a9eb5d94b8d24b19291ed9d0830c	sha256	—	80	1
1c01ab1b59245f24ebdc5d9c414fcf4e2ce31f71f181522efc5a3d27476c8e21	sha256	—	80	1
5a23ca644cb1f310be1abd5f6c6a3b3e15681ced99b0947a7f3465a79aae5089	sha256	—	80	1
a8acc24bb3e6a1a3b66a31ceaefda07d4a0e17415468683458b499f2ba240450	sha256	—	80	1
d55ce447e249ef9045750865fa196c8ca8434c8c484f861b7bdecbceeab7c16e	sha256	—	80	1
ad0f892b7b99b68491ade4949ef6b575e64d9df5f84a53019b5c1e4eeb4c46a9	sha256	—	80	1
1d699a46339626db299548e32ed3a77eec267840c3de39b49caf38b88aeb150d	sha256	—	80	1
3e17ce0b30b9fd6863b341ae58ee118dc13f2ee7f1c92ac4b81c04d54480d0e0	sha256	—	80	1
4991873515d6dea70d7769cf67ccd8ea69184e5e454a6e6d1e093b6a3c48eb47	sha256	—	80	1
512adab2c69feaf026adfb12cbd7d2eb4fee746120491e44f476eebddcbb19f2	sha256	—	80	1
5562246e38f8935ba8b07350e6aaa44bc22abf37b77f49836fde5999f4b61cf1	sha256	—	80	1
66bf111030a2e22db575c0b7b7b677208745eef8b44265bb4259f41f126f1bf8	sha256	—	80	1
8419b1f0acca46d45f4c54c315c8cc4784946e07d547fe55187b928fa6c6b8f5	sha256	—	80	1
85816d89dac648645a9026973772815e956c267232b3d2577a06a43418f19ed3	sha256	—	80	1
a4b34b94a905fe330b0a3e4502aa45356e383a8f45ff1d008b785ea0ec14acaf	sha256	—	80	1

Showing the top 30 by severity of 200.