Detect Software Discovery in IBM QRadar
Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries use this information during automated discovery to shape follow-on behaviors — including whether to fully infect the target, which vulnerabilities to exploit for privilege escalation, or which security tools to evade. Common techniques include querying the Windows Registry uninstall keys, WMI Win32_Product class, PowerShell Get-Package cmdlet, and command-line tools such as wmic and reg. On Linux and macOS, adversaries use package managers (dpkg, rpm, brew) and filesystem enumeration of application directories.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1518 Software Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1518/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
sourceip AS SourceIP,
username AS Username,
"ProcessName",
"CommandLine",
"ParentProcessName",
LOGSOURCENAME(logsourceid) AS LogSource,
CATEGORYNAME(category) AS Category,
CASE
WHEN "CommandLine" ILIKE '%Win32_Product%' OR "CommandLine" ILIKE '%product get%' OR "CommandLine" ILIKE '%product list%' THEN 'WMI_Software_Enum'
WHEN "CommandLine" ILIKE '%CurrentVersion\Uninstall%' OR "CommandLine" ILIKE '%Uninstall%' AND "ProcessName" ILIKE '%reg.exe%' THEN 'Registry_Uninstall_Query'
WHEN "CommandLine" ILIKE '%Get-Package%' OR "CommandLine" ILIKE '%Win32_InstalledWin32Program%' OR "CommandLine" ILIKE '%InstalledProgramFramework%' THEN 'PS_GetPackage'
WHEN "CommandLine" ILIKE '%dpkg%' OR "CommandLine" ILIKE '%rpm -q%' OR "CommandLine" ILIKE '%snap list%' OR "CommandLine" ILIKE '%brew list%' OR "CommandLine" ILIKE '%yum list%' OR "CommandLine" ILIKE '%apt list%' OR "CommandLine" ILIKE '%dnf list%' THEN 'PackageManager_Enum'
ELSE 'Generic_Software_Discovery'
END AS DiscoveryType,
CASE
WHEN LOWER("ParentProcessName") LIKE '%powershell.exe%' OR LOWER("ParentProcessName") LIKE '%pwsh.exe%'
OR LOWER("ParentProcessName") LIKE '%wscript.exe%' OR LOWER("ParentProcessName") LIKE '%cscript.exe%'
OR LOWER("ParentProcessName") LIKE '%mshta.exe%' OR LOWER("ParentProcessName") LIKE '%rundll32.exe%'
OR LOWER("ParentProcessName") LIKE '%regsvr32.exe%' THEN 3
WHEN LOWER("ProcessName") LIKE '%wmic.exe%' THEN 2
ELSE 1
END AS RiskScore
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'LinuxAuthLog', 'Sysmon')
AND starttime > NOW() - 86400000
AND (
-- wmic product enumeration
(LOWER("ProcessName") LIKE '%wmic.exe%' AND (
LOWER("CommandLine") LIKE '%product get%' OR
LOWER("CommandLine") LIKE '%product list%' OR
LOWER("CommandLine") LIKE '%product where%' OR
LOWER("CommandLine") LIKE '%win32_product%'
))
-- reg query uninstall
OR (LOWER("ProcessName") LIKE '%reg.exe%' AND LOWER("CommandLine") LIKE '%uninstall%')
-- PowerShell software discovery
OR ((LOWER("ProcessName") LIKE '%powershell.exe%' OR LOWER("ProcessName") LIKE '%pwsh.exe%') AND (
LOWER("CommandLine") LIKE '%get-package%' OR
LOWER("CommandLine") LIKE '%win32_product%' OR
LOWER("CommandLine") LIKE '%win32_installedwin32program%' OR
LOWER("CommandLine") LIKE '%get-wmiobject%' OR
LOWER("CommandLine") LIKE '%get-ciminstance%' OR
LOWER("CommandLine") LIKE '%currentversion\uninstall%' OR
LOWER("CommandLine") LIKE '%installedprogramframework%'
))
-- Linux/macOS package manager enumeration
OR ((LOWER("ProcessName") LIKE '%bash%' OR LOWER("ProcessName") LIKE '%/sh%' OR LOWER("ProcessName") LIKE '%zsh%') AND (
LOWER("CommandLine") LIKE '%dpkg -l%' OR
LOWER("CommandLine") LIKE '%dpkg --list%' OR
LOWER("CommandLine") LIKE '%rpm -qa%' OR
LOWER("CommandLine") LIKE '%snap list%' OR
LOWER("CommandLine") LIKE '%brew list%' OR
LOWER("CommandLine") LIKE '%apt list%' OR
LOWER("CommandLine") LIKE '%yum list installed%' OR
LOWER("CommandLine") LIKE '%dnf list installed%'
))
)
AND NOT (
(LOWER("ParentProcessName") LIKE '%msiexec.exe%' OR LOWER("ParentProcessName") LIKE '%trustedinstaller.exe%' OR LOWER("ParentProcessName") LIKE '%ccmexec.exe%')
AND (LOWER(username) LIKE '%system%' OR LOWER(username) LIKE '%nt authority%')
)
ORDER BY starttime DESCAQL query detecting software discovery activity through WMI, registry, PowerShell, and package manager enumeration. Correlates process execution events from Windows Security logs, Sysmon, and Linux audit logs. Assigns risk scores based on suspicious parent process inheritance indicative of post-exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Endpoint management platforms (SCCM, BigFix, ManageEngine) perform scheduled WMI-based software inventory that will match WMI enumeration patterns during discovery cycles
- Security compliance scanning tools (Nessus, Qualys, Rapid7) execute reg.exe and wmic.exe queries against Uninstall keys during credentialed vulnerability assessments
- Linux build and CI/CD pipelines frequently enumerate installed packages via dpkg or rpm during dependency resolution and environment validation stages
Other platforms for T1518
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 WMIC Product Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'product get'. WMI Activity Event IDs 5857/5858/5859 in Microsoft-Windows-WMI-Activity/Operational. File creation event (Sysmon Event ID 11) for %TEMP%\software_inv.csv. Security Event ID 4688 (if command line auditing enabled).
- Test 2 Registry Query for Installed Software (reg.exe)
Expected signal: Sysmon Event ID 1: Two Process Create events for reg.exe with CommandLine containing 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'. Registry access events (Sysmon Event ID 12/13) if registry monitoring is configured. Security Event ID 4688 for both reg.exe executions.
- Test 3 PowerShell Software Discovery via Get-Package
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Package' and 'Export-Csv'. PowerShell ScriptBlock Log Event ID 4104 in Microsoft-Windows-PowerShell/Operational with the full cmdlet. Sysmon Event ID 11 (File Create) for the CSV output in TEMP.
- Test 4 Linux Package Enumeration via dpkg and rpm
Expected signal: Auditd EXECVE records for dpkg, rpm, snap, awk, and cat process invocations. Syslog entries if process accounting is enabled. On endpoints with Sysmon for Linux (sysmonforlinux): Event ID 1 process creation events for each command in the pipeline. File creation event for /tmp/dpkg_inv.txt.
References (7)
- https://attack.mitre.org/techniques/T1518/
- https://learn.microsoft.com/en-us/powershell/module/packagemanagement/get-package
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1518/T1518.md
- https://www.mandiant.com/resources/blog/unc3890-targets-israel
- https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-banking-malware/
- https://unit42.paloaltonetworks.com/siloscape/
Response Playbook
Triage
- Identify the initiating process and parent chain — was software discovery invoked from a legitimate management tool (ccmexec.exe, qualys, tanium) or from an unexpected parent like powershell.exe launched by an Office document, wscript.exe, or mshta.exe?
- Check the user context — is this a service account associated with a known inventory system, a system administrator, or an interactive user who would not normally run software enumeration commands?
- Assess the breadth of enumeration — a single reg query may be incidental, but a sequence of registry reads, WMI queries, and PowerShell cmdlets within a short window suggests automated discovery reconnaissance
- Correlate with adjacent discovery events — check for T1033 (System Owner Discovery), T1007 (System Service Discovery), T1082 (System Information Discovery), T1016 (System Network Configuration Discovery) occurring within the same session timeframe on the same host
- For WMI-based discovery (Win32_Product), note that this provider triggers a Windows Installer repair check on all installed applications — unusual for non-admin users and generates substantial I/O activity that may be visible in performance logs
- Check if the discovered software list was exfiltrated — look for outbound network connections from the same process or follow-on processes writing to temp directories, network shares, or initiating HTTP/S connections shortly after enumeration
Containment
- If software discovery is confirmed as part of an active intrusion, isolate the affected endpoint using EDR network isolation to prevent follow-on exploitation based on discovered software versions
- If the enumeration was performed by a compromised service account, disable the account and revoke active sessions; reset the password and audit all systems the account accessed
- Capture a memory image and disk snapshot before containment actions if the host shows other indicators of compromise (e.g., T1059, T1105, T1055) — software discovery alone is insufficient grounds for immediate reimaging
- Block lateral movement paths: if discovered software includes remote management tools (RMM, VNC, SSH clients), monitor for those tools being abused for lateral movement to other systems
- If discovered software included vulnerable versions of applications (e.g., outdated browsers, unpatched Java), treat as high-risk and prioritize incident response — the adversary may be actively planning exploitation
Evidence Collection
- Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing enabled via GPO: Audit Process Creation + Include command line in process creation events)
- Registry Access Events — Sysmon Event ID 12/13/14 for registry key access if key logging is enabled; note default Sysmon configs may not capture all registry reads
- PowerShell ScriptBlock Logging — Event ID 4104 in Microsoft-Windows-PowerShell/Operational, which captures the full script content including Get-Package and Get-WmiObject calls
- WMI Activity Logging — Event ID 5857/5858/5859/5860/5861 in Microsoft-Windows-WMI-Activity/Operational for WMI provider queries including Win32_Product
- Windows Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ — enumerate these to understand what software the adversary could have discovered
- Command History — PSReadLine history at $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt for PowerShell commands; .bash_history for Linux systems
- Prefetch Files — C:\Windows\Prefetch\WMIC.EXE-*.pf and REG.EXE-*.pf for execution timestamps and frequency
- Network Connections — Sysmon Event ID 3 shortly after discovery events to determine if enumeration results were transmitted
Escalation Criteria
- !Software discovery immediately precedes or follows exploitation attempts — e.g., adversary queries installed Java or browser versions, then attempts T1068 (Exploitation for Privilege Escalation) targeting the discovered version
- !Discovery is performed against multiple systems in rapid succession, indicating automated lateral movement or a worm-like capability spreading through the network
- !The user or process performing software discovery has no legitimate business reason to inventory software, and the account has no history of this activity in baseline telemetry
- !Discovered software inventory is written to a staging directory or exfiltrated — look for output redirection (wmic product get > C:\Users\Public\inv.txt) or immediate upload attempts
- !Software discovery is one of multiple concurrent discovery techniques (T1007, T1033, T1082, T1016) being executed in the same session, indicating a systematic post-exploitation reconnaissance phase
- !Known threat actor tooling is identified in the parent process chain — e.g., Cobalt Strike beacon (beacon.exe, svchost.exe with unusual command lines) spawning wmic.exe for software enumeration
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ — primary software inventory key; each subkey contains DisplayName, DisplayVersion, Publisher, InstallDate - >
Registry: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ — 32-bit applications on 64-bit systems - >
Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ — per-user installed applications - >
File System: C:\Windows\Prefetch\WMIC.EXE-*.pf — execution evidence for wmic with timestamps and run count - >
File System: C:\Windows\Prefetch\REG.EXE-*.pf — execution evidence for reg.exe - >
Event Log: Microsoft-Windows-WMI-Activity/Operational — Event IDs 5857-5861 for WMI provider activity including Win32_Product queries - >
Event Log: Microsoft-Windows-PowerShell/Operational — Event ID 4104 ScriptBlock logs capturing Get-Package, Get-WmiObject, Get-CimInstance calls - >
Event Log: Security — Event ID 4688 process creation (if command line auditing enabled via: Computer Configuration > Policies > Administrative Templates > System > Audit Process Creation > Include command line in process creation events) - >
Linux: /var/log/auth.log or /var/log/secure — shell command history for dpkg/rpm/snap invocations - >
Linux: /root/.bash_history and /home/*/.bash_history — command history files - >
macOS: /private/var/log/system.log and unified log for system_profiler or ls /Applications invocations - >
Memory: Running process list at time of incident — any processes with wmic, reg, or PowerShell holding open handles to registry hives
Tuning Guidance
Software discovery is a noisy technique with high false positive rates in environments with active software management tooling. Start by building an allowlist of known inventory service accounts and their parent processes: SCCM (ccmexec.exe), Tanium (TaniumClient.exe), Qualys (QualysAgent.exe), Rapid7 (ir_agent.exe), Tenable (nessus-service). Exclude these accounts and parent processes from alerting, but retain them in hunting datasets for anomaly detection. For WMIC-based discovery specifically, the Win32_Product provider triggers MSI repair checks — this is distinctive behavior that creates measurable I/O load and is rarely used by legitimate tools in favor of faster alternatives (Win32_InstalledWin32Program). Consider creating a higher-confidence alert specifically for Win32_Product queries from non-inventory-tool parents. On the registry side, most legitimate inventory tools use dedicated APIs rather than reg.exe directly; reg.exe querying Uninstall keys from interactive sessions is a stronger signal. For PowerShell, combine the software discovery cmdlet match with other discovery indicators in the same session (T1082, T1007, T1033) to raise confidence — an adversary doing full recon will chain these. Set minimum severity to Low initially, promote to Medium for hosts where software discovery precedes other post-exploitation techniques within 30 minutes.
Hunting Queries
Hunt for software discovery events followed by privilege escalation indicators within a 1-hour window on the same host and account. This sequence — enumerate software to identify vulnerable versions, then attempt exploitation — is characteristic of hands-on-keyboard adversary activity in post-exploitation phases.
// Hunt for software discovery preceding exploitation attempts within 1 hour
let SoftwareDiscovery = DeviceProcessEvents
| where Timestamp > ago(7d)
| where (
(FileName =~ "wmic.exe" and ProcessCommandLine has_any ("product get", "Win32_Product"))
or (FileName =~ "reg.exe" and ProcessCommandLine has "Uninstall")
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Package", "Win32_Product", "Win32_InstalledWin32Program"))
)
| project DiscoveryTime=Timestamp, DeviceName, AccountName, DiscoveryCmd=ProcessCommandLine;
let PrivEscAttempts = DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessIntegrityLevel in ("High", "System")
| where InitiatingProcessIntegrityLevel in ("Medium", "Low")
| project EscalationTime=Timestamp, DeviceName, AccountName, EscalationCmd=ProcessCommandLine, EscalatingProcess=FileName;
SoftwareDiscovery
| join kind=inner PrivEscAttempts on DeviceName, AccountName
| where EscalationTime between (DiscoveryTime .. (DiscoveryTime + 1h))
| project DiscoveryTime, EscalationTime, DeviceName, AccountName, DiscoveryCmd, EscalatingProcess, EscalationCmd
| sort by DiscoveryTime descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
(Image="*\\wmic.exe" CommandLine="*product get*")
OR (Image="*\\reg.exe" CommandLine="*Uninstall*")
OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Get-Package*" OR CommandLine="*Win32_Product*"))
)
| eval DiscoveryTime=_time
| eval DiscoveryHost=host
| eval DiscoveryUser=User
| append [
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(IntegrityLevel="High" OR IntegrityLevel="System")
NOT (Image="*\\trustedinstaller.exe" OR Image="*\\msiexec.exe")
| eval EscalationTime=_time
| eval EscalationHost=host
| eval EscalationUser=User
]
| stats values(Image) as Images values(CommandLine) as CmdLines min(_time) as earliest max(_time) as latest by host, User
| where mvcount(Images) > 1
| eval window_minutes=round((latest - earliest) / 60, 1)
| where window_minutes < 60
| sort - latestHunt for a single account performing software discovery across three or more distinct hosts within a 2-hour window. Legitimate software inventory tools run as dedicated service accounts on predictable schedules; an interactive user account or a service account touching multiple systems rapidly suggests lateral movement with reconnaissance activity.
// Hunt for bulk software discovery across multiple hosts from the same account (lateral spread indicator)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (
(FileName =~ "wmic.exe" and ProcessCommandLine has_any ("product get", "Win32_Product", "product list"))
or (FileName =~ "reg.exe" and ProcessCommandLine has "Uninstall")
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Package", "Win32_Product", "Win32_InstalledWin32Program", "Get-CimInstance"))
)
| summarize
DiscoveryCount = count(),
UniqueHosts = dcount(DeviceName),
HostList = make_set(DeviceName, 20),
CommandVariants = make_set(ProcessCommandLine, 5),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by AccountName, FileName
| where UniqueHosts >= 3
| extend SpreadRateMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| where SpreadRateMinutes <= 120
| sort by UniqueHosts descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
(Image="*\\wmic.exe" (CommandLine="*product get*" OR CommandLine="*Win32_Product*"))
OR (Image="*\\reg.exe" CommandLine="*Uninstall*")
OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Get-Package*" OR CommandLine="*Win32_Product*" OR CommandLine="*Get-CimInstance*"))
)
| bucket _time span=2h
| stats count as DiscoveryCount, dc(host) as UniqueHosts, values(host) as HostList, values(CommandLine) as CmdVariants by User, Image, _time
| where UniqueHosts >= 3
| sort - UniqueHostsHunt for software discovery commands that include output redirection operators or cmdlets (>, >>, Out-File, Export-Csv) writing results to common staging locations (Public, Temp, ProgramData). This pattern indicates the adversary is saving enumeration results for later exfiltration rather than viewing them interactively.
// Hunt for software discovery output being written to disk (exfiltration staging)
let DiscoveryWithOutput = DeviceProcessEvents
| where Timestamp > ago(7d)
| where (
ProcessCommandLine has_any ("product get", "Win32_Product", "Uninstall", "Get-Package", "Win32_InstalledWin32Program")
)
| where ProcessCommandLine has_any (">>", ">", "Out-File", "Set-Content", "Add-Content", "Tee-Object", "Export-Csv")
| project DiscoveryTime=Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
let StagingLocations = DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("\\Users\\Public\\", "\\Temp\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\", "\\Windows\\Temp\\")
| where FileName endswith ".txt" or FileName endswith ".csv" or FileName endswith ".log" or FileName endswith ".xml"
| project FileTime=Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessAccountName;
DiscoveryWithOutput
| join kind=leftouter StagingLocations
on DeviceName
, $left.AccountName == $right.InitiatingProcessAccountName
| where FileTime between (DiscoveryTime .. (DiscoveryTime + 5m))
| project DiscoveryTime, DeviceName, AccountName, ProcessCommandLine, FileName, FolderPath
| sort by DiscoveryTime descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
(Image="*\\wmic.exe" CommandLine="*product*")
OR (Image="*\\reg.exe" CommandLine="*Uninstall*")
OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Get-Package*" OR CommandLine="*Win32_Product*"))
)
(CommandLine="*>*" OR CommandLine="*Out-File*" OR CommandLine="*Export-Csv*" OR CommandLine="*Set-Content*")
| eval staging_indicator=if(match(CommandLine, "(public|temp|appdata|programdata)"), 1, 0)
| table _time, host, User, Image, CommandLine, ParentImage, staging_indicator
| sort - _timeAtomic Red Team Tests
Uses Windows Management Instrumentation Command-line (wmic) to enumerate all installed software via the Win32_Product WMI class. This is a well-documented adversary technique used by Volt Typhoon, Dridex, and numerous post-exploitation frameworks to inventory installed applications. Note: Win32_Product triggers an MSI consistency check (repair) on all installed applications — this creates measurable I/O load and unusual MSI events.
Command
wmic product get Name,Version,Vendor /format:csv > %TEMP%\software_inv.csvCleanup
del %TEMP%\software_inv.csvExpected Telemetry
Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'product get'. WMI Activity Event IDs 5857/5858/5859 in Microsoft-Windows-WMI-Activity/Operational. File creation event (Sysmon Event ID 11) for %TEMP%\software_inv.csv. Security Event ID 4688 (if command line auditing enabled).
Expected Detection
KQL: ProcessBranch matches FileName=wmic.exe with 'product get' in ProcessCommandLine, RiskScore=2. SPL: DiscoveryType=WMI_Software_Enum, RiskScore=2. Hunting query 3 may additionally fire if output redirection to TEMP is detected.
Uses the built-in reg.exe utility to query the Windows Uninstall registry keys directly, enumerating all 64-bit and 32-bit installed software. This technique is faster than Win32_Product and does not trigger MSI repair checks, making it preferred by adversaries who need to minimize noise. This matches the behavior documented for Volt Typhoon querying the Registry for installed software.
Command
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s /v DisplayName && reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s /v DisplayNameExpected Telemetry
Sysmon Event ID 1: Two Process Create events for reg.exe with CommandLine containing 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'. Registry access events (Sysmon Event ID 12/13) if registry monitoring is configured. Security Event ID 4688 for both reg.exe executions.
Expected Detection
KQL: ProcessBranch matches FileName=reg.exe with 'Uninstall' in ProcessCommandLine. SPL: DiscoveryType=Registry_Uninstall_Query. RegistryBranch in KQL may additionally fire if registry key access monitoring is active.
Uses the PowerShell Get-Package cmdlet to enumerate all installed software packages across all registered package providers (Programs, MSI, NuGet, etc.). This is a modern, script-friendly equivalent of WMIC product enumeration and is used by malware families like CharmPower and Dridex that rely on PowerShell for post-exploitation discovery.
Command
powershell.exe -NoProfile -Command "Get-Package | Select-Object Name,Version,ProviderName | Export-Csv -Path $env:TEMP\pkg_inv.csv -NoTypeInformation"Cleanup
Remove-Item $env:TEMP\pkg_inv.csv -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Package' and 'Export-Csv'. PowerShell ScriptBlock Log Event ID 4104 in Microsoft-Windows-PowerShell/Operational with the full cmdlet. Sysmon Event ID 11 (File Create) for the CSV output in TEMP.
Expected Detection
KQL: ProcessBranch matches FileName=powershell.exe with 'Get-Package' in ProcessCommandLine. SPL: DiscoveryType=PS_GetPackage. Hunting query 3 additionally fires on output redirection to TEMP path.
Enumerates all installed packages on Linux systems using dpkg (Debian/Ubuntu) and rpm (RHEL/CentOS) package manager commands. This matches behavior observed in XCSSET and various Linux backdoors that enumerate installed software to identify security tools and target applications for injection or evasion.
Command
dpkg -l 2>/dev/null | awk 'NR>5 {print $2, $3}' > /tmp/dpkg_inv.txt; rpm -qa --qf '%{NAME} %{VERSION}\n' 2>/dev/null >> /tmp/dpkg_inv.txt; snap list 2>/dev/null >> /tmp/dpkg_inv.txt; cat /tmp/dpkg_inv.txtCleanup
rm -f /tmp/dpkg_inv.txtExpected Telemetry
Auditd EXECVE records for dpkg, rpm, snap, awk, and cat process invocations. Syslog entries if process accounting is enabled. On endpoints with Sysmon for Linux (sysmonforlinux): Event ID 1 process creation events for each command in the pipeline. File creation event for /tmp/dpkg_inv.txt.
Expected Detection
KQL: ProcessBranch matches FileName in (bash, sh) with 'dpkg -l' or 'rpm -qa' in ProcessCommandLine, DetectionSource=Process. SPL: DiscoveryType=PackageManager_Enum.