Techniques › T1518 › T1518.001
T1518.001 Security Software Discovery
discovery — IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
9
Sigma rules tagged attack.t1518.001
0
KEV CVEs mapped here
<p>Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.</p><p>Example commands that can be used to obtain security software information are netsh, <code>reg query</code> with Reg, <code>dir</code> with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.</p><p>Adversaries may also utilize the Cloud API to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0016 Security Software Discovery Across Platforms v1.0
AN0048 WindowsAdversary executes commands to enumerate installed antivirus, EDR, or firewall agents using WMI, registry queries, and built-in tools (e.g., tasklist, netsh, sc query). Correlated with elevated process privileges or scripting engine usage.Tunable:
ParentProcessImagePathContainsAN0049 LinuxAdversary runs discovery commands such asps aux,systemctl status, orcat /etc/init.d/to enumerate security software or services. Often occurs alongside privilege escalation or bash script execution.Tunable:ExecutableNameTimeWindowAN0050 macOSAdversary attempts to detect monitoring agents such as Little Snitch, KnockKnock, or other system daemons via process listing (ps -e), application folder checks, and system extension listing.macos:unifiedlogexecution of security-agent detection or enumeration commands→ DC0064 Command ExecutionTunable:ToolNameMatch
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1518.001
Author: Daniil Yugoslavskiy, oscd.community
· 2020-10-19 (modified 2022-11-27) · logsource: product=macos category=process_creation · 0ed75b9c-c73b-424d-9e7d-496cd565fbe0
Detects usage of system utilities (only grep for now) to discover security software discovery
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2024-01-02 · logsource: product=macos category=process_creation · 3603f18a-ec15-43a1-9af2-d196c8a7fec6
Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.
Author: frack113
· 2021-12-16 (modified 2023-11-14) · logsource: product=windows category=process_creation · 37db85d1-b089-490a-a59a-c7b6f984f480
Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2023-10-20 (modified 2023-11-14) · logsource: product=windows category=process_creation · 4fe074b4-b833-4081-8f24-7dcfeca72b42
Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results.
This detection focuses on the keywords that the attacker might use as a filter.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2024-01-02 · logsource: product=macos category=process_creation · 53821412-17b0-4147-ade0-14faae67d54b
Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.
Author: frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems)
· 2021-12-16 (modified 2023-10-24) · logsource: product=windows category=ps_script · 904e8e61-8edf-4350-b59c-b905fc8e810c
Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes.
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus
Author: Daniil Yugoslavskiy, oscd.community
· 2020-10-19 (modified 2022-11-27) · logsource: product=linux category=process_creation · c9d8b7fd-78e4-44fe-88f6-599135d46d60
Detects usage of system utilities (only grep and egrep for now) to discover security software discovery
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2023-07-13 · logsource: product=windows category=ps_module · ea207a23-b441-4a17-9f76-ad5be47d51d3
Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
Author: Tom3306
· 2026-08-19 · logsource: product=windows category=process_creation · f14b1e99-5e53-4598-98dc-6f20ad7b35e0
Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
Rules tagged at the parent level (attack.t1518) 4
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nikita Nazarov, oscd.community
· 2020-10-16 (modified 2022-12-02) · logsource: product=windows category=ps_script · 2650dd1a-eb2a-412d-ac36-83f06c4f2282
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Nikita Nazarov, oscd.community
· 2020-10-16 (modified 2022-10-09) · logsource: product=windows category=process_creation · e13f668e-7f95-443d-98d2-1816a7648a7b
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.