AN1100
Analytic 1100
Windows
Adversary spawns a process or script to enumerate installed software using WMI, registry, or PowerShell, potentially followed by additional discovery or evasion behavior.
WinEventLog:Security
EventCode=4688
WinEventLog:PowerShell
Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets
[TimeWindow]
Detection may be scoped to multiple discovery commands within a short timeframe.
[ParentProcess]
Tuning based on whether discovery activity stems from suspicious versus approved management tools.
AN1101
Analytic 1101
Linux
Adversary invokes 'dpkg -l', 'rpm -qa', or other package managers via shell or script to enumerate installed software.
auditd:SYSCALL
Execution of dpkg, rpm, or other package manager with list flag
linux:shell
Manual invocation of software enumeration commands via interactive shell
[ScriptName]
Path to the wrapper script that invokes enumeration commands.
[TTYContext]
Scope detection to interactive vs. background shell contexts.
AN1102
Analytic 1102
macOS
Adversary runs 'system_profiler SPApplicationsDataType' or queries plist files to enumerate software via Terminal or scripts.
macos:unifiedlog
Execution of system_profiler or osascript invoking enumeration
auditd:SYSCALL
Command line arguments including SPApplicationsDataType
[AppScope]
Whether enumeration targets user apps or system apps.
[ProcessGroup]
Parent process or scripting environment (e.g., Python, osascript).
AN1103
Analytic 1103
IaaS
Adversary uses cloud-native APIs or CLI (e.g., AWS Systems Manager, Azure Resource Graph) to list installed software on cloud workloads.
AWS:CloudTrail
ssm:ListInventoryEntries
AWS:CloudTrail
ssm:GetCommandInvocation
[UserAgent]
Differentiate access from automated scripts vs. authorized console.
[InventoryType]
May focus on Application or Platform inventory only.
AN1104
Analytic 1104
ESXi
Adversary uses 'esxcli software vib list' to enumerate installed VIBs, drivers, and modules.
esxi:shell
esxcli software vib list
esxi:hostd
Host daemon command log entries related to vib enumeration
[HostAccessMode]
Detection may vary based on whether enumeration is local or remote.
[ScriptChain]
Presence of enumeration in broader scripted sequence.