Software Discovery: Backup Software Discovery
- ID
- T1518.002
- Tactics
- TA0007 Discovery
- Sub-technique of
- T1518 Software Discovery
- Platforms
- Windows, macOS, Linux
- Data sources
- Process Creation, Windows Registry Key Modification, File Creation, File Access
- Source
- attack.mitre.org
- MITRE last modified
- 22 Oct 2025
Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as Data Destruction, Inhibit System Recovery, or Data Encrypted for Impact.
Commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.[1]
Detection
- DET0088 Backup Software Discovery via CLI, Registry, and Process Inspection (T1518.002)
Data components: Process Creation, Windows Registry Key Modification, File Creation, File Access