Technique:  Software Discovery
Bazar can query the Registry for installed applications.
It has used tools to enumerate software installed on an infected host.
Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.
CharmPower can list the installed applications on a compromised host.
The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.
ComRAT can check the victim's default browser to determine which process to inject its communications module into.
down_new has the ability to gather information on installed applications.
Dridex has collected a list of installed software on the system.
DustySky lists all installed software for the infected machine.
Dyre has the ability to identify installed programs on a compromised host.
It has enumerated programs installed on an infected machine.
HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.
It has enumerated installed software on compromised systems.
InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.
KGH_SPY can collect information on installed applications.
MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.
Metamorfo has searched the compromised system for banking applications.
It has used a PowerShell backdoor to check for Skype connectivity on the target machine.
It has searched the victim system for the InstallUtil.exe program and its version.
During Operation Dust Storm, the threat actors deployed a file called DeployJava.js to fingerprint installed software on a victim system prior to exploit delivery.
During Operation Wocao, threat actors collected a list of installed software on the infected system.
Orz can gather the victim's Internet Explorer version.
P.A.S. Webshell can list PHP server configuration details.
QakBot can enumerate a list of installed programs.
It can scan victim drives to look for specific banking software on the machine to determine next actions.
ShimRatReporter gathered a list of installed software on the infected host.
It has collected browser information from a compromised host.
It has used tools to enumerate software installed on an infected host.
Siloscape searches for the kubectl binary.
SpicyOmelette can enumerate running software on a targeted system.
SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.
SVCReady can collect a list of installed software from an infected host.
TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.
It's backdoor could list the infected system's installed software.
It has queried the Registry on compromised systems for information on installed software.
It has used a script to detect installed software on targeted systems.
It has used malware to identify installed software.
It has utilized the PowerShell script Get-DataInfo.ps1 to collect installed backup software information from a compromised machine.
Woody RAT can collect .NET, PowerShell, and Python information from an infected host.
XCSSET uses ps aux with the grep command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.