Cross-source coverage
T1518.001 / ATT&CK
Software Discovery: Security Software Discovery
21 rules across 6 sources.
From MITRE ATT&CK 19.2
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.
Adversaries may also utilize the Cloud API to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
- Tactics
- Discovery
- Platforms
- IaaS · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlog
How MITRE says to detect it DET0016
Security Software Discovery Across Platforms
Windows Analytic 0048
Adversary executes commands to enumerate installed antivirus, EDR, or firewall agents using WMI, registry queries, and built-in tools (e.g., tasklist, netsh, sc query). Correlated with elevated process privileges or scripting engine usage.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=7
Linux Analytic 0049
Adversary runs discovery commands such as `ps aux`, `systemctl status`, or `cat /etc/init.d/` to enumerate security software or services. Often occurs alongside privilege escalation or bash script execution.
auditd:SYSCALLexecve
macOS Analytic 0050
Adversary attempts to detect monitoring agents such as Little Snitch, KnockKnock, or other system daemons via process listing (`ps -e`), application folder checks, and system extension listing.
macos:unifiedlogexecution of security-agent detection or enumeration commandsauditd:SYSCALLexecve
SigmaHQ/sigma
9 rules| Detection | Severity | Format |
|---|---|---|
| Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE | High | Sigma |
| Security Software Discovery - MacOs | Medium | Sigma |
| Security Software Discovery Via Powershell Script | Medium | Sigma |
| Security Tools Keyword Lookup Via Findstr.EXE | Medium | Sigma |
| System Integrity Protection (SIP) Disabled | Medium | Sigma |
| Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet | Low | Sigma |
| PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy | Low | Sigma |
| Security Software Discovery - Linux | Low | Sigma |
| System Integrity Protection (SIP) Enumeration | Low | Sigma |
socfortress/Wazuh-Rules
4 rules| Detection | Severity | Format |
|---|---|---|
| Discovery of security software using ps aux (T1518.001) | High | Wazuh XML |
| Attempt to enumerate security software using egrep (T1518.001) | Medium | Wazuh XML |
| Attempt to enumerate security software using pgrep (T1518.001) | Medium | Wazuh XML |
| Wrapped shell command for security software discovery (T1518.001) | Medium | Wazuh XML |
Bert-JanP/Hunting-Queries-Detection-Rules
3 rules| Detection | Severity | Format |
|---|---|---|
| List Defender Discovery Activities | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
| WMIC Antivirus Discovery | Undefined | KQL |
Wazuh Core Ruleset
2 rules| Detection | Severity | Format |
|---|---|---|
| WMI command was used for AV product discovery | High | Wazuh XML |
| Powershell tampering with WMI AntiVirusProduct class - Antivirus Software discovery | Medium | Wazuh XML |
elastic/protections-artifacts
2 rules| Detection | Severity | Format |
|---|---|---|
| Security Tooling Enumeration | Undefined | Elastic TOML |
| Suspicious Security Product Enumeration | Undefined | Elastic TOML |
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Security Software Discovery via Grep | Medium | Elastic TOML |