Software Discovery
Software discovery inventories installed products and versions to guide further actions.
What it means
Software discovery inventories installed products and versions to guide further actions. Results can reveal defenses, valuable applications, and compatible targets.
An investigation example
An unknown process enumerates installed products before changing its execution path.
Evidence to examine
Review inventory queries, caller provenance, output artifacts, and conditional behavior informed by discovered products.
A common analytical pitfall
Approved management tools perform the same inventory, so enumeration alone has limited evidentiary value.
Response considerations
Correlate discovery with initial access and later actions and distinguish routine inventory from an unauthorized operational sequence.
An installed product is a clue about capability
Software discovery identifies products or components available on a host. Version information and configuration can help explain the system's role and possible next actions. The result does not establish that the software was running, vulnerable, or used during the incident. Installation, execution, and exploitation are separate propositions.
Managed inventory tools, installers, and support software routinely collect this information. Assess the querying process, account, scope, and timing against expected administration. Some applications are portable or bundled and may not appear in a normal installed-product list. A missing entry is not proof that the software is absent from the filesystem.
A fictional security-tool check
An academy sees an unfamiliar process enumerate installed products shortly after opening a suspicious attachment. The process later changes its behavior on hosts with a particular security tool. Analysts compare endpoint events and environmental differences without assuming that the product-listing event alone explains every outcome.
Software names can be ambiguous, and version strings may not capture vendor backports or local configuration. If the investigation concerns a vulnerability, verify the advisory's affected conditions against the actual installation. Do not infer a successful exploit from the presence of an older-looking version number. Preserve the source of the reported version and any uncertainty.
Compare inventory and execution
Use a fictional software inventory and a separate process log. Identify one installed application with no observed execution and one running component absent from the inventory. Write plausible explanations and the next evidence source to examine. This develops reasoning about coverage rather than treating either list as a complete truth.
The same distinction matters for response scope. A component found on several devices may justify checking them, but it does not prove they all experienced the same behavior. Prioritize follow-up using exposure, execution evidence, and relevant business context instead of multiplying one host's conclusion across the entire inventory.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1518: Software Discovery