Description
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.
Adversaries may also utilize the Cloud API to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Platforms
Threat Groups (27)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has identified security software, configurations, defensive tools, and sensors installed on a compromis... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) enumerated installed security products during operations.(Citation: Microsoft BlackByte 2023) |
| G1008 | SideCopy | [SideCopy](https://attack.mitre.org/groups/G1008) uses a loader DLL file to collect AV product names from an infected host.(Citation: MalwareBytes Sid... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has checked for the presence of antivirus software with <code>powershell Get-CimInstance -Namespace r... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) scanned the “Program Files” directories for a directory with the string “Total Security” (the insta... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used malware to check running processes against a hard-coded list of security tools often used... |
| G0019 | Naikon | [Naikon](https://attack.mitre.org/groups/G0019) uses commands such as <code>netsh advfirewall firewall</code> to discover local firewall settings.(Cit... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used PowerShell scripts to identify security software on the victim machine.(Citation: Sy... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has searched for security products on infected machines.(Citation: ATT TeamTNT Chimaera September 202... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used the Windows service <code>winmgmts:\\.\root\SecurityCenter2</code> to check installed ant... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) used scripts which detected and uninstalled antivirus software.(Citation: Talos Rocke August 2018)(Cita... |
| G1018 | TA2541 | [TA2541](https://attack.mitre.org/groups/G1018) has used tools to search victim systems for security products such as antivirus and firewall software.... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) can search for anti-virus software running on the system.(Citation: Unit 42 Tropic Trooper Nov... |
| G0143 | Aquatic Panda | [Aquatic Panda](https://attack.mitre.org/groups/G0143) has attempted to discover third party endpoint detection and response (EDR) tools on compromise... |
| G0089 | The White Company | [The White Company](https://attack.mitre.org/groups/G0089) has checked for specific antivirus products on the target’s computer, including Kaspersky, ... |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) has obtained information on security software, including security logging information that may indicate... |
| G1053 | Storm-0501 | [Storm-0501](https://attack.mitre.org/groups/G1053) has detected endpoint security solutions using `sc query sense` and `sc query windefend`.(Citation... |
| G1051 | Medusa Group | [Medusa Group](https://attack.mitre.org/groups/G1051) has detected security solutions for termination or deletion within the victim device using hard-... |
| G0012 | Darkhotel | [Darkhotel](https://attack.mitre.org/groups/G0012) has searched for anti-malware strings and anti-virus processes running on the system.(Citation: Sec... |
| G0112 | Windshift | [Windshift](https://attack.mitre.org/groups/G0112) has used malware to identify installed AV and commonly used forensic and malware analysis tools.(Ci... |
Associated Software (111)
| ID | Name | Type | Context |
|---|---|---|---|
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can identify specific analytical tools based on running processes.(Citation: Proofpoint Bumblebee... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) has checked for a variety of antivirus products.(Citation: Korean FSI TA505 2020)(Citation: BlackBer... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) enumerates the currently running processes related to a variety of security products.(Citation: Nic... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) may collect information on the victim's anti-virus software.(Citation: FireEye APT34 Dec 2017) |
| S1193 | TAMECAT | Malware | [TAMECAT](https://attack.mitre.org/software/S1193) has used Windows Management Instrumentation (WMI) to check for anti-virus products.(Citation: Mandi... |
| S0171 | Felismus | Malware | [Felismus](https://attack.mitre.org/software/S0171) checks for processes associated with anti-virus vendors.(Citation: Forcepoint Felismus Mar 2017) |
| S0330 | Zeus Panda | Malware | [Zeus Panda](https://attack.mitre.org/software/S0330) checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s en... |
| S0491 | StrongPity | Malware | [StrongPity](https://attack.mitre.org/software/S0491) can identify if ESET or BitDefender antivirus are installed before dropping its payload.(Citatio... |
| S0653 | xCaon | Malware | [xCaon](https://attack.mitre.org/software/S0653) has checked for the existence of Kaspersky antivirus software on the system.(Citation: Checkpoint Ind... |
| S9026 | ROAMINGHOUSE | Malware | [ROAMINGHOUSE](https://attack.mitre.org/software/S9026) can identify McAfee applications on compromised hosts and change its execution method if one i... |
| S1239 | TONESHELL | Malware | [TONESHELL](https://attack.mitre.org/software/S1239) has checked for the presence of ESET antivirus applications `ekrn.exe` and `egui.exe`.(Citation: ... |
| S0088 | Kasidet | Malware | [Kasidet](https://attack.mitre.org/software/S0088) has the ability to identify any anti-virus installed on the infected system.(Citation: Zscaler Kasi... |
| S1244 | Medusa Ransomware | Malware | [Medusa Ransomware](https://attack.mitre.org/software/S1244) has the capability to detect security solutions for termination or deletion within the vi... |
| S0115 | Crimson | Malware | [Crimson](https://attack.mitre.org/software/S0115) contains a command to collect information about anti-virus software on the victim.(Citation: Proofp... |
| S1159 | DUSTTRAP | Malware | [DUSTTRAP](https://attack.mitre.org/software/S1159) can identify security software.(Citation: Google Cloud APT41 2024) |
| S1028 | Action RAT | Malware | [Action RAT](https://attack.mitre.org/software/S1028) can identify AV products on an infected host using the following command: `cmd.exe WMIC /Node:lo... |
| S0473 | Avenger | Malware | [Avenger](https://attack.mitre.org/software/S0473) has the ability to identify installed anti-virus products on a compromised host.(Citation: Trend Mi... |
| S0113 | Prikormka | Malware | A module in [Prikormka](https://attack.mitre.org/software/S0113) collects information from the victim about installed anti-virus software.(Citation: E... |
| S1228 | PUBLOAD | Malware | [PUBLOAD](https://attack.mitre.org/software/S1228) has identified AV products on an infected host using the following command: `WMIC /Node:localhost ... |
| S1065 | Woody RAT | Malware | [Woody RAT](https://attack.mitre.org/software/S1065) can detect Avast Software, Doctor Web, Kaspersky, AVG, ESET, and Sophos antivirus programs.(Citat... |
Frequently Asked Questions
What is T1518.001 (Security Software Discovery)?
T1518.001 is a MITRE ATT&CK technique named 'Security Software Discovery'. It belongs to the Discovery tactic(s). Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cl...
How can T1518.001 be detected?
Detection of T1518.001 (Security Software Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1518.001?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1518.001?
Known threat groups using T1518.001 include: APT38, BlackByte, SideCopy, Kimsuky, Patchwork, MuddyWater, Naikon, Gamaredon Group.