Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1518.002sub-technique of T1518 Software Discovery

Backup Software Discovery

Windows · macOS · Linuxnothing on this site yetT1518.002 on attack.mitre.org

Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as Data Destruction, Inhibit System Recovery, or Data Encrypted for Impact.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Backup Software Discovery via CLI, Registry, and Process Inspection (T1518.002)

  • Defender observes execution of commands like `tasklist`, `sc query`, `reg query`, or PowerShell WMI/Registry queries targeting known backup products (e.g., Veeam, Acronis, CrashPlan).
  • Defender observes use of CLI tools (`find`, `grep`, `ls`, `dpkg`, `rpm`, `systemctl`, `ps aux`) to discover backup agents or config files (e.g., rsnapshot, duplicity, veeam).
  • Defender detects execution of `mdfind`, `launchctl`, or GUI-based enumeration (e.g., `/Applications/Time Machine.app`) along with command-line usage of `find`, `grep`, or `system_profiler` to identify installed backup tools like Time Machine, Carbon Copy Cloner, or Backblaze.

the rest of T1518

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.