Software discovery is the enumeration of installed applications, utilities, and tools on a host. Attackers use it to learn what the victim runs, such as browsers, password managers, cloud CLI tools, developer software, remote access clients, or security products. That information helps them judge whether a machine is worth further attention and which follow-on actions are most likely to succeed.
In real attacks, software discovery often happens early after compromise and may be paired with broader host-information gathering. A malware operator may query the registry, file system, installed-program lists, process data, or application paths to map the environment. Defenders care because this reconnaissance can reveal valuable secrets or indicate an attacker is preparing persistence, credential theft, or evasion. Monitoring unusual inventory commands, rapid enumeration after execution, and suspicious access to system metadata can help detect it. Reducing local secret sprawl and hardening endpoints also makes discovered software less useful to an intruder.