Security Software Discovery (T1518.001) is a Discovery technique. Adversaries try to list security software, configurations, defensive tools and sensors on a system or in a cloud environment, such as cloud monitoring agents and antivirus. MITRE lists IaaS, Linux, macOS and Windows.
How attackers use it
The result guides what the adversary does next, including whether to fully infect the target. MITRE lists example commands: netsh, reg query with Reg, dir with cmd, and Tasklist, plus more specific checks depending on the product. It notes that macOS malware increasingly checks for LittleSnitch and KnockKnock.
In the cloud, adversaries may use the Cloud API to find cloud native security software on compute, such as the AWS CloudWatch agent, Azure VM Agent and Google Cloud Monitor agent.
How to detect it
MITRE's analytics, by platform:
- Windows: commands that enumerate antivirus, EDR or firewall agents through WMI, registry queries and built in tools such as tasklist, netsh and sc query, especially with elevated privileges or a scripting engine.
- Linux: discovery commands such as ps aux, systemctl status or reading the init.d folder, often alongside privilege escalation or a bash script.
- macOS: checks for monitoring agents like Little Snitch or KnockKnock by process listing, application folder checks and system extension listing.
Alert on a burst of several of these commands from one parent process in a short time. One lookup is noise. A sequence is a pattern.
How to reduce the risk
MITRE does not list mitigations for this technique, because it abuses legitimate system features. Aim for detection, and make your security agents tamper resistant and monitored for unexpected stops, so that a failed check is visible.
Quick check
What makes this discovery different from a general software listing?
The target is defensive tooling. The result tells the adversary what could detect them and whether to proceed.
