{"id":"T1518.001","name":"Security Software Discovery","url":"https://attack.mitre.org/techniques/T1518/001","tactics":["discovery"],"platforms":["IaaS","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0016","stix_id":"x-mitre-detection-strategy--e2409f82-e24c-4bb9-ad44-b20d97fb7a5a","name":"Security Software Discovery Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0016","analytics":[{"id":"AN0048","stix_id":"x-mitre-analytic--d0d1375d-f5c2-4271-b5e7-415c478d5e86","name":"Analytic 0048","description":"Adversary executes commands to enumerate installed antivirus, EDR, or firewall agents using WMI, registry queries, and built-in tools (e.g., tasklist, netsh, sc query). Correlated with elevated process privileges or scripting engine usage.","url":"https://attack.mitre.org/detectionstrategies/DET0016#AN0048","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ParentProcess","description":"Defenders can tune based on trusted or known-good parent process relationships"},{"field":"ImagePathContains","description":"Regex match on adversary tool or enumeration script used"}],"live":true,"detection_strategies":["DET0016"],"techniques":["T1518.001"]},{"id":"AN0049","stix_id":"x-mitre-analytic--3928ff9c-961e-455c-a2b1-d79ca788591f","name":"Analytic 0049","description":"Adversary runs discovery commands such as `ps aux`, `systemctl status`, or `cat /etc/init.d/` to enumerate security software or services. Often occurs alongside privilege escalation or bash script execution.","url":"https://attack.mitre.org/detectionstrategies/DET0016#AN0049","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ExecutableName","description":"Adjust for custom script names or wrappers used in the environment"},{"field":"TimeWindow","description":"Tuning threshold for multiple enumeration commands within short duration"}],"live":true,"detection_strategies":["DET0016"],"techniques":["T1518.001"]},{"id":"AN0050","stix_id":"x-mitre-analytic--9d76d84b-6393-45cf-b872-eb5921508ee3","name":"Analytic 0050","description":"Adversary attempts to detect monitoring agents such as Little Snitch, KnockKnock, or other system daemons via process listing (`ps -e`), application folder checks, and system extension listing.","url":"https://attack.mitre.org/detectionstrategies/DET0016#AN0050","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"execution of security-agent detection or enumeration commands","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ToolNameMatch","description":"Adversary may search for specific software names; defenders can tune based on local deployments"}],"live":true,"detection_strategies":["DET0016"],"techniques":["T1518.001"]}],"live":true,"version":"1.0","techniques":["T1518.001"]}],"sigma_rules":[{"id":"0ed75b9c-c73b-424d-9e7d-496cd565fbe0","title":"Security Software Discovery - MacOs","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"medium","date":"2020-10-19","modified":"2022-11-27","description":"Detects usage of system utilities (only grep for now) to discover security software discovery","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1518.001"],"path":"rules/macos/process_creation/proc_creation_macos_security_software_discovery.yml","techniques":["T1518.001"],"cves":[]},{"id":"3603f18a-ec15-43a1-9af2-d196c8a7fec6","title":"System Integrity Protection (SIP) Disabled","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2024-01-02","modified":null,"description":"Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.\n","references":["https://ss64.com/osx/csrutil.html","https://objective-see.org/blog/blog_0x6D.html","https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/","https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1518.001"],"path":"rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml","techniques":["T1518.001"],"cves":[]},{"id":"37db85d1-b089-490a-a59a-c7b6f984f480","title":"Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE","author":"frack113","status":"test","level":"high","date":"2021-12-16","modified":"2023-11-14","description":"Detects usage of \"findstr\" with the argument \"385201\". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1518.001"],"path":"rules/windows/process_creation/proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml","techniques":["T1518.001"],"cves":[]},{"id":"4fe074b4-b833-4081-8f24-7dcfeca72b42","title":"Security Tools Keyword Lookup Via Findstr.EXE","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2023-10-20","modified":"2023-11-14","description":"Detects execution of \"findstr\" to search for common names of security tools. Attackers often pipe the results of recon commands such as \"tasklist\" or \"whoami\" to \"findstr\" in order to filter out the results.\nThis detection focuses on the keywords that the attacker might use as a filter.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery","https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/","https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1518.001"],"path":"rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml","techniques":["T1518.001"],"cves":[]},{"id":"53821412-17b0-4147-ade0-14faae67d54b","title":"System Integrity Protection (SIP) Enumeration","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"low","date":"2024-01-02","modified":null,"description":"Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.\n","references":["https://ss64.com/osx/csrutil.html","https://objective-see.org/blog/blog_0x6D.html","https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/","https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1518.001"],"path":"rules/macos/process_creation/proc_creation_macos_csrutil_status.yml","techniques":["T1518.001"],"cves":[]},{"id":"904e8e61-8edf-4350-b59c-b905fc8e810c","title":"Security Software Discovery Via Powershell Script","author":"frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2021-12-16","modified":"2023-10-24","description":"Detects calls to \"get-process\" where the output is piped to a \"where-object\" filter to search for security solution processes.\nAdversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1518.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml","techniques":["T1518.001"],"cves":[]},{"id":"c9d8b7fd-78e4-44fe-88f6-599135d46d60","title":"Security Software Discovery - Linux","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"low","date":"2020-10-19","modified":"2022-11-27","description":"Detects usage of system utilities (only grep and egrep for now) to discover security software discovery","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1518.001"],"path":"rules/linux/process_creation/proc_creation_lnx_security_software_discovery.yml","techniques":["T1518.001"],"cves":[]},{"id":"ea207a23-b441-4a17-9f76-ad5be47d51d3","title":"Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","status":"test","level":"low","date":"2023-07-13","modified":null,"description":"Detects execution of \"Get-NetFirewallRule\" or \"Show-NetFirewallRule\" to enumerate the local firewall rules on a host.","references":["https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps","https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps"],"logsource":{"product":"windows","category":"ps_module"},"tags":["detection.threat-hunting","attack.discovery","attack.t1518.001","attack.t1016"],"path":"rules-threat-hunting/windows/powershell/powershell_module/posh_pm_susp_netfirewallrule_recon.yml","techniques":["T1518.001","T1016"],"cves":[]},{"id":"f14b1e99-5e53-4598-98dc-6f20ad7b35e0","title":"PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy","author":"Tom3306","status":"experimental","level":"low","date":"2026-08-19","modified":null,"description":"Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.\n","references":["https://learn.microsoft.com/en-us/powershell/module/applocker/get-applockerpolicy"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1518.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_applocker_policy_discovery_via_get_applockerpolicy.yml","techniques":["T1518.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}