Was the "installedcomp.pl" plugin actually intended to be distributed with RR4.0?

[CmdrBurrito]

Hi Harlan,

Just checking in to see if you actually intended to remove the plugin "installedcomp.pl" from RR4.0, but accidentally did not?

I ask because "installedcomp.pl" is the only RR4.0 plugin that doesn't have a MITRE reference within it.

I also see another plugin named "activesetup.pl" which includes the following note within its change history "- Near-complete overhaul of installedcomp.pl plugin".

Regards!

[CmdrBurrito]

More specifically, that plugin ("installedcomp.pl") does not have a MITRE element present within its "%config" Perl hash.

[keydet89]

Which MITRE ATT&CK technique would you recommend?

[CmdrBurrito]

Assuming that plugin is still supposed to be there, in spite of the presence of "activesetup.pl", then I think "T1547" would probably be good, since it's the same MITRE ATT&CK technique that you currently have for the "activesetup.pl" plugin. However, if you do that, you might also want to change the category of the "installedcomp.pl" plugin from "malware" to "persistence".

[CmdrBurrito]

This is the wrong forum for this question, as such I am closing this issue.