Cross-source coverage
T1063 / ATT&CK
Security Software Discovery
ATT&CK has retired this technique. Rules still tag it; the current id is T1518.001 Software Discovery: Security Software Discovery.
2 rules · 1 family across 1 source.
1 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Windows
Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.
Mac
It's becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.
- Tactics
- Discovery
- Platforms
- macOS · Windows
- Telemetry
- —
socfortress/Wazuh-Rules
2 rules · 1 family| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · Security Software Discovery (T1063) 2 variants | Low | Wazuh XML |
| Sysmon - Event 1: Process creation · Security Software Discovery (T1063) 2 variants | Low | Wazuh XML |