T1518.002 — Backup Software Discovery

Tactic: Discovery · Platforms: Windows, macOS, Linux

Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as Data Destruction, Inhibit System Recovery, or Data Encrypted for Impact. Commands that can be used to obtain…

Sub-technique of Software Discovery (T1518).

Sigma detection rules (3)

title: "T1518.002 Software Discovery: Backup Software Discovery"
id: cdc48ded-1c3e-4105-ab7c-cb0becc3c947
description: 'Detects process-creation commands used to enumerate installed backup software: reg query against known backup-vendor registry keys, vssadmin list, and wbadmin get; the prior file_event logsource paired with EventID 13/14 was invalid since those Sysmon registry events only fire on writes, never on read/query operations like reg query. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: KnownBackupVendors, UserContextScope, SuspiciousParentProcesses.'
references:
  - https://attack.mitre.org/techniques/T1518/002
author: Shahrukh Khan
date: 2026-06-16
license: MIT
tags:
  - attack.discovery
  - attack.t1518.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_regquery:
    EventID: '1'
    Image|endswith: '\reg.exe'
    CommandLine|contains: 'query'

  selection_vendors:
    CommandLine|contains:
      - 'Veeam'
      - 'Acronis'
      - 'Veritas'
      - 'CommVault'
      - 'Arcserve'
      - 'Backup Exec'
      - 'ShadowProtect'

  selection_vssadmin:
    EventID: '1'
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'list'

  selection_wbadmin:
    EventID: '1'
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'get versions'
      - 'get catalog'
      - 'get status'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: ((selection_regquery and selection_vendors) or selection_vssadmin or selection_wbadmin) and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.
  - Backup administrators legitimately querying backup software status or versions.

level: medium

title: "T1518.002 Software Discovery: Backup Software Discovery"
id: f0882754-6eea-4b33-b71d-af4f8808f4c1
description: 'Backup Software Discovery via Package and Service Enumeration (T1518.002). The prior version matched find searches for ".bak" files and paths containing "/etc/" or ".conf", which is generic file discovery unrelated to identifying installed backup software, and its second selection branch omitted the type: EXECVE constraint, letting it match non-process auditd records. This version instead matches package-manager, process, and service-enumeration commands (dpkg, rpm, apt, yum, dnf, pgrep, systemctl, which) whose arguments reference known backup-software names such as Veeam, Acronis, Bacula, restic, BorgBackup, duplicity, timeshift, and rsnapshot. Tune using: BackupConfigPaths, ToolchainScope.'
references:
  - https://attack.mitre.org/techniques/T1518/002
author: Shahrukh Khan
date: 2026-01-14
license: MIT
tags:
  - attack.discovery
  - attack.t1518.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_query:
    type: EXECVE
    a0|endswith:
      - '/dpkg'
      - '/rpm'
      - '/apt'
      - '/apt-get'
      - '/yum'
      - '/dnf'
      - '/pgrep'
      - '/systemctl'
      - '/which'
  selection_keyword_a1:
    a1|contains:
      - 'veeam'
      - 'acronis'
      - 'bacula'
      - 'restic'
      - 'borgbackup'
      - 'duplicity'
      - 'timeshift'
      - 'rsnapshot'
  selection_keyword_a2:
    a2|contains:
      - 'veeam'
      - 'acronis'
      - 'bacula'
      - 'restic'
      - 'borgbackup'
      - 'duplicity'
      - 'timeshift'
      - 'rsnapshot'

  condition: selection_query and (selection_keyword_a1 or selection_keyword_a2)

falsepositives:
  - Legitimate sysadmin inventory/audit of installed backup tooling, or monitoring scripts checking backup-service status; scope ToolchainScope/BackupConfigPaths to expected admin accounts and known backup-management windows.

level: informational

title: "T1518.002 Software Discovery: Backup Software Discovery"
id: cd869280-3b78-4c39-87f2-9c8cc3f7bc9b
description: 'Backup Software Discovery via CLI, Registry, and Process Inspection (T1518.002). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: InstallLocationScope, KnownAppPlistPaths.'
references:
  - https://attack.mitre.org/techniques/T1518/002
author: Shahrukh Khan
date: 2026-02-24
license: MIT
tags:
  - attack.discovery
  - attack.t1518.002

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/system_profiler'
      - '/spctl'
      - '/pluginkit'
  selection_args:
    CommandLine|contains:
      - 'SPApplicationsDataType'
      - '--list'
      - 'com.apple.security'
  condition: selection and selection_args

falsepositives:
  - Routine software inventory and license compliance scans run by IT tools issue the same enumeration commands, so this only becomes meaningful when preceding execution of a payload that targets a discovered security product.

level: informational

Related sub-techniques

• T1518.001 Security Software Discovery

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1518.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan