Skip to content

Software Discovery

Technique · ATTACK:enterprise:T1518

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1518",
  "title": "Software Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1518",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e3b6daca-e963-4a69-aee6-ed4fd653ad58",
  "external_id": "T1518",
  "domain": "enterprise",
  "created": "2019-09-16T17:52:44.147Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [

  ]
}

Explicit source assertions (56)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--082b64f6-cc70-4bc8-a49f-bf0f125883f7

FireEye Metamorfo Apr 2018 · ESET Casbaneiro Oct 2019

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ecc1e3a-340a-42b6-9739-c6a243ffaa8f

trendmicro xcsset xcode project 2020

ATTACK:enterprise:S0623 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--163851e2-5236-41cb-897f-06e33624c3ec

Unit 42 Siloscape Jun 2021

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16ccf88b-5f28-41d3-bc34-6580be0dbe3f

CISA AA24-038A PRC Critical Infrastructure February 2024 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17317bb7-40a1-47a0-8200-c89df3a339b2

Check Point APT35 CharmPower January 2022

ATTACK:enterprise:S0445 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--222ce94a-bb33-476b-b4c3-56b529d9af03

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b89f806-5b78-4599-9536-13b47c35d26d

Kaspersky MoleRATs April 2019

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cfb6d2b-5a32-4ff9-9eb8-83a051eaff0d

Kandji Cuckoo April 2024

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f8394e6-2cf2-473a-b60a-6de2e69c39c8

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31029adf-2b28-4d7f-bdd3-b07f55374eae

ESET ComRAT May 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3407bbe8-bceb-42f1-824b-d92d9972d917

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39c98d86-3f44-4a47-b7e5-4cb3e4bf97a7

ESET ForSSHe December 2018

ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c9c3d3d-a209-43dc-ae8d-53cd4c1de65c

Symantec Inception Framework March 2018

ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41e8c16e-bfef-415f-b898-b76a1f527cc2

Checkpoint Dridex Jan 2021

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45e1151f-d4f7-478a-8bb5-78e4698a8a06

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S0646 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4859e904-e404-4bae-a106-d347c9cc2e18

Secureworks GOLD KINGSWOOD September 2018

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5166f101-8d87-4967-bc3c-5f6ee97b863c

IBM StrelaStealer 2024

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53e1f658-489e-41ac-849a-335998544cf5

Aqua Security Trivy Compromise MAR 2026 · Wiz Trivy Compromise MAR 2026

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54e0e380-aef8-4c63-9792-ebda05affee6

Trend Micro Tick November 2019

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61387ea8-b511-4a66-9d99-c89a72017476

Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

ATTACK:enterprise:C0044 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6729138f-01ef-485e-89ee-4d33c749ef72

ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:S0229 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70059c24-ccde-4832-854e-3bcb71c294a9

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--715262b6-9d31-4589-ba53-fb5d7be3f1f5

BlackBerry Bahamut

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77c3f6a1-f25c-4669-bdc1-0f358793dd34

Trend Micro Muddy Water March 2021

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--794403a3-232e-4cc3-85e2-cc997825dfa8

Cybereason Bazar July 2020

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8455e704-68fd-4610-b63d-0d124a660802

Kaspersky TajMahal April 2019

ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87e99b39-e634-477e-b260-6098abc58dc2

ANSSI Sandworm January 2021

ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91038a74-575b-4f2e-9dba-767b50b8e4ab

MacKeeper Bundlore Apr 2019

ATTACK:enterprise:T1518.001 → subtechnique-of → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9395c820-d828-4dea-bcde-88c4baf06440

ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93d35fd7-3a55-4de1-a568-0fa50f81d594

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:T1518.002 → subtechnique-of → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94290be1-1085-40ab-a0f9-fbd98dbd0a34

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6fd818c-d0a6-44ca-b80d-abb80af9acac

Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab058a49-a8fc-403d-ae97-9137625c82d7

ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac2b9eab-5d0e-4ab5-9b5b-eebd454737d6

Anomali MUSTANG PANDA October 2019

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af7ec7e9-08d2-4459-8c05-047185799058

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b78b92b1-deab-4ac1-b1c5-ceb6fa28810a

Secureworks Gold Prelude Profile

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bad8e857-fe92-49d3-8bd7-50a6665c0902

Huntress LightSpy macOS 2024

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1214ef3-9bff-4702-8f54-4e6ddf955d93

Cylance Dust Storm

ATTACK:enterprise:S0472 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c61ca699-62e8-4c42-b20c-3c042c0fb153

Trend Micro Tick November 2019

ATTACK:enterprise:S9029 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c78ed1f7-5a62-4153-8230-df01164232f4

Check Point Wirte NOV 2024

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9767024-ff9a-4c20-b29c-5270874f8cd1

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb72e7c8-23a4-40d8-916e-99a18db9039c

Koi Glassworm New Tricks December 2025

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d066c8bf-591c-4923-8794-5336cd568ab2

HP SVCReady Jun 2022

ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d07460c8-0d13-4c25-81f7-56e5198f07c5

Carbon Black HotCroissant April 2020

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1a2cd6c-1c7b-4c1a-9416-106e7951642c

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3971408-ef1b-4aae-9477-3319a1b97523

Kaspersky Lyceum October 2021

ATTACK:enterprise:S0526 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd4c57df-6ddc-4a41-b1ee-5f72556fc57d

Cybereason Kimsuky November 2020

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e342ee2b-d7b6-4a48-a689-06a68efe589e

Group IB Ransomware September 2020

ATTACK:enterprise:S0024 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4489924-d87d-4a18-8702-418361f6a2bb

Malwarebytes Dyreza November 2015

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e848e92c-af22-4284-a27d-7c2673a4b0fe

FoxIT Wocao December 2019

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea245e90-c14f-457c-998f-04c431dcc458

Splunk RedLine Stealer June 2023

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ebcc66b8-e5ed-4e4e-9646-4b37672e9ba9

Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f372cb23-0736-4cbb-8ba0-3388599226f9

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f60ed279-c720-4906-9e63-3cd7ce49e1e0

ESET RTM Feb 2017

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f79c163a-25c0-4694-b1ca-50ab1eda8651

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S1099 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff6c2e20-53c1-4840-8bc6-e404e627ad82

Kaspersky ToddyCat June 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.