Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

T1518.002 Backup Software Discovery · cyberstrikeus | DecimalAI

cyberstrikeus/T1518.002_backup-software-discovery

SkillScore96Maintained

Adversaries may attempt to get a listing of backup software or configurations that are installed on a system.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1518.002

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1518-002-backup-software-discovery/SKILL.md

decimalai skills pull cyberstrikeus-t1518-002-backup-software-discovery --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1518-002-backup-software-discovery/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1518-002-backup-software-discovery/SKILL.md

Raw file: /s/cyberstrikeus-t1518-002-backup-software-discovery/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1518-002-backup-software-discovery.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +39% lift-33% tokens0% turns96% of whole cases pass with skill (22/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	19%	0%
case-01	✗→✓	▲ Improved	13%	0%
case-07	✗→✓	▲ Improved	-61%	0%
case-09	✗→✓	▲ Improved	-72%	0%
case-11	✗→✓	▲ Improved	-65%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0007_discovery/T1518.002_backup-software-discovery/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1518.002 Backup Software Discovery

> Sub-technique of: T1518

High-Level Description

Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as Data Destruction, Inhibit System Recovery, or Data Encrypted for Impact.

Commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.

Kill Chain Phase

Discovery (TA0007)

Platforms: Windows, macOS, Linux

What to Check

] Identify if Backup Software Discovery technique is applicable to target environment
] Check Windows systems for indicators of Backup Software Discovery
] Check macOS systems for indicators of Backup Software Discovery
] Check Linux systems for indicators of Backup Software Discovery
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Backup Software Discovery by examining the target platforms (Windows, macOS, Linux).

Assess Existing Defenses: Review whether mitigations for T1518.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

No specific mitigations documented for this technique.

Detection

Backup Software Discovery via CLI, Registry, and Process Inspection (T1518.002)

Risk Assessment

| Finding | Severity | Impact | | ---------------------------------------------- | -------- | --------- | | Backup Software Discovery technique applicable | Medium | Discovery |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-200 | Exposure of Sensitive Information |

References

Illustrative Want to see what cyberstrikeus/T1518.002_backup-software-discovery would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 19:46 UTC · 23 cases

Lift

+39%

96% vs 57%

Agent turns

0%

1.0 vs 1.0

Tokens

-34%

1,902 vs 2,858.57

fail → pass · 9pass → pass · 13fail → fail · 1

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-03 I am building a security review document for MITRE ATT&CK T1518.002. Please generate a structured assessment summary that outlines the attack surface checks for Windows, macOS, and Linux, instructions for evaluating existing defensive controls, and a standard findings table summarizing severity and impact.	fail→pass	23,232	21,779	-6%	1	1	0%	3,766	4,469	+19%	0	0	—
case-02 Our incident response team needs an audit checklist for detecting adversary recon aimed at installed backup applications (such as Veeam, Acronis, or Dropbox) across OS environments. Can you produce a technical verification guide that lists evaluation steps for multi-platform environments, testing instructions, detection strategy review, and overall risk impact classification?	fail→fail	35,254	26,223	-26%	1	1	0%	5,302	5,370	+1%	0	0	—
case-01 We are conducting a threat evaluation across our mixed enterprise endpoints (Windows, Linux, and macOS) to address MITRE ATT&CK sub-technique T1518.002. Please provide an assessment guide detailing what platforms and host activities to inspect for backup software enumeration, how to manually test our defenses, and how findings should be categorized in terms of risk severity and CWE mapping.	fail→pass	36,723	41,749	+14%	1	1	0%	5,572	6,271	+13%	0	0	—
case-04 When an attacker scans enterprise hosts to identify installed backup agents, a novice analyst might assume the primary goal is network credential harvesting or privilege escalation. What specific follow-on behaviors are defined for this discovery activity?	pass→pass	17,499	4,773	-73%	1	1	0%	2,045	1,353	-34%	0	0	—
case-05 Enterprise defenders often search process lists for standard AV engines when auditing software discovery. For backup-specific discovery under MITRE ATT&CK, which commercial backup software products are explicitly highlighted as indicators?	pass→pass	21,748	4,654	-79%	1	1	0%	2,316	1,257	-46%	0	0	—
case-06 Security teams often assume attackers only use PowerShell cmdlets or third-party binaries to discover backup software. Which standard Windows command-line utilities are cited for process and registry inspection?	pass→pass	15,787	8,702	-45%	1	1	0%	1,801	1,281	-29%	0	0	—
case-07 Automated testing frameworks usually have ready-to-run Atomic Red Team tests for every sub-technique. How many Atomic Red Team test scripts are currently available for sub-technique T1518.002?	fail→pass	11,966	8,407	-30%	1	1	0%	2,492	975	-61%	0	0	—
case-08 Security compliance teams usually demand a list of MITRE ATT&CK mitigations (such as M1047 or M1022) to enforce. What specific mitigations are documented in the skill guide for T1518.002?	pass→pass	30,886	4,210	-86%	1	1	0%	4,000	1,352	-66%	0	0	—
case-09 Defenders often create complex multi-part detection rules covering dozens of log sources. How many detection strategies are documented for assessing sub-technique T1518.002, and what telemetry area do they cover?	fail→pass	26,560	7,437	-72%	1	1	0%	3,791	1,079	-72%	0	0	—
case-10 When scoping host discovery reviews, administrators sometimes assume backup software discovery is exclusively a Windows concern. Which operating system platforms are within scope for sub-technique T1518.002?	pass→pass	15,566	7,961	-49%	1	1	0%	2,025	1,119	-45%	0	0	—
case-11 When executing manual security verification, analysts often jump straight to executing commands. What is the explicit first step specified in the manual testing workflow for T1518.002?	fail→pass	21,581	3,103	-86%	1	1	0%	2,739	967	-65%	0	0	—
case-12 In the manual testing procedure for T1518.002, what is the mandatory second step before running execution tools?	fail→pass	18,295	7,157	-61%	1	1	0%	2,230	1,027	-54%	0	0	—
case-13 What is the third procedural step defined in the manual testing framework for sub-technique T1518.002?	pass→pass	20,846	2,002	-90%	1	1	0%	2,824	989	-65%	0	0	—
case-14 Security consultants often create varied finding titles like 'Unsanitized Backup Query' or 'Backup Binary Exposure'. What exact finding description is specified in the risk assessment table for sub-technique T1518.002?	fail→pass	30,754	3,069	-90%	1	1	0%	6,159	961	-84%	0	0	—
case-15 Audit reports often rate technical discovery findings as having 'System Compromise' or 'Privilege Escalation' impact. What impact level is assigned in the risk assessment table for T1518.002?	fail→pass	17,393	2,182	-87%	1	1	0%	1,635	1,075	-34%	0	0	—
case-16 Risk frameworks often map discovery activities to authorization flaws like CWE-284 or CWE-269. Which specific Common Weakness Enumeration entry is designated for sub-technique T1518.002?	pass→pass	25,188	6,805	-73%	1	1	0%	3,913	964	-75%	0	0	—
case-17 Threat analysts sometimes confuse backup discovery with Execution (TA0002) or Defense Evasion (TA0005). Which MITRE ATT&CK tactic phase does T1518.002 belong to?	pass→pass	13,711	2,444	-82%	1	1	0%	1,663	1,056	-37%	0	0	—
case-18 Threat intelligence analysts often reference generic LockBit or Conti playbooks when studying backup discovery. Which specific 2023 threat intelligence report on Play ransomware is cited as a primary reference?	pass→pass	12,672	8,163	-36%	1	1	0%	1,166	1,045	-10%	0	0	—
case-19 When mapping sub-techniques back to core ATT&CK categories, analysts might associate backup enumeration with T1082 System Information Discovery. What is the actual parent technique ID for backup software discovery?	pass→pass	14,961	7,602	-49%	1	1	0%	1,937	1,070	-45%	0	0	—
case-20 When completing the 'What to Check' checklist, auditors might focus solely on host OS indicators. What specific detection strategy check item is included in the checklist?	fail→pass	13,079	7,247	-45%	1	1	0%	1,294	1,034	-20%	0	0	—
case-21 Our SOC team needs an audit checklist for MITRE ATT&CK T1518.001 (Security Software Discovery) to monitor process enumeration targeting Windows Defender, CrowdStrike Falcon, and local firewalls. What tools, WMI queries, and detection focus apply to security software discovery?	pass→pass	25,832	30,591	+18%	1	1	0%	3,709	4,499	+21%	0	0	—
case-22 An adversary executed vssadmin delete shadows /all /quiet and wbadmin delete catalog to destroy local system backups on a domain controller. How is this behavior categorized under MITRE ATT&CK, and what specific mitigations exist to protect shadow copies?	pass→pass	24,113	19,134	-21%	1	1	0%	2,663	2,906	+9%	0	0	—
case-23 An attacker ran systeminfo on a Windows host and uname -a on Linux to inspect OS build numbers and CPU architecture. How does MITRE ATT&CK classify this general OS environment discovery and what is its technique ID?	pass→pass	9,065	7,201	-21%	1	1	0%	705	1,627	+131%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +39 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 56.5%
Pass rate with the skill: 95.7%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 19:46 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

I am building a security review document for MITRE ATT&CK T1518.002. Please generate a structured assessment summary that outlines the attack surface checks for Windows, macOS, and Linux, instructions for evaluating existing defensive controls, and a standard findings table summarizing severity and impact.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run96

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-33% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 23 days ago

Other measured skills in the registry, with their headline benchmark lift.