// MITRE ATT&CK
T1518.002 · Backup Software Discovery
Sub-técnica de T1518 · Software Discovery.
Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/t...
¿Cómo detectarlo y mitigarlo?
La detección de Backup Software Discovery parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Técnicas relacionadas
T1033
System Owner/User Discovery T1613
Container and Resource Discovery T1016.001
Internet Connection Discovery T1069
Permission Groups Discovery T1069.003
Cloud Groups T1615
Group Policy Discovery T1652
Device Driver Discovery T1087.002
Domain Account
System Owner/User Discovery T1613
Container and Resource Discovery T1016.001
Internet Connection Discovery T1069
Permission Groups Discovery T1069.003
Cloud Groups T1615
Group Policy Discovery T1652
Device Driver Discovery T1087.002
Domain Account
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.