# T1518.001 - Security Software Discovery
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1518/001)
<blockquote>Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.

Adversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.(Citation: Expel IO Evil in AWS)</blockquote>

## Atomic Tests

- [Atomic Test #1 - Security Software Discovery](#atomic-test-1---security-software-discovery)

- [Atomic Test #2 - Security Software Discovery - powershell](#atomic-test-2---security-software-discovery---powershell)

- [Atomic Test #3 - Security Software Discovery - ps (macOS)](#atomic-test-3---security-software-discovery---ps-macos)

- [Atomic Test #4 - Security Software Discovery - ps (Linux)](#atomic-test-4---security-software-discovery---ps-linux)

- [Atomic Test #5 - Security Software Discovery - Sysmon Service](#atomic-test-5---security-software-discovery---sysmon-service)

- [Atomic Test #6 - Security Software Discovery - AV Discovery via WMI](#atomic-test-6---security-software-discovery---av-discovery-via-wmi)


<br/>

## Atomic Test #1 - Security Software Discovery
Methods to identify Security Software on an endpoint

when sucessfully executed, the test is going to display running processes, firewall configuration on network profiles
and specific security software.

**Supported Platforms:** Windows


**auto_generated_guid:** f92a380f-ced9-491f-b338-95a991418ce2






#### Attack Commands: Run with `command_prompt`! 


```cmd
netsh.exe advfirewall  show allprofiles
tasklist.exe
tasklist.exe | findstr /i virus
tasklist.exe | findstr /i cb
tasklist.exe | findstr /i defender
tasklist.exe | findstr /i cylance
```






<br/>
<br/>

## Atomic Test #2 - Security Software Discovery - powershell
Methods to identify Security Software on an endpoint

when sucessfully executed, powershell is going to processes related AV products if they are running.

**Supported Platforms:** Windows


**auto_generated_guid:** 7f566051-f033-49fb-89de-b6bacab730f0






#### Attack Commands: Run with `powershell`! 


```powershell
get-process | ?{$_.Description -like "*virus*"}
get-process | ?{$_.Description -like "*carbonblack*"}
get-process | ?{$_.Description -like "*defender*"}
get-process | ?{$_.Description -like "*cylance*"}
```






<br/>
<br/>

## Atomic Test #3 - Security Software Discovery - ps (macOS)
Methods to identify Security Software on an endpoint
when sucessfully executed, command shell  is going to display AV/Security software it is running.

**Supported Platforms:** macOS


**auto_generated_guid:** ba62ce11-e820-485f-9c17-6f3c857cd840






#### Attack Commands: Run with `sh`! 


```sh
ps aux | egrep 'Little\ Snitch|CbOsxSensorService|falcond|nessusd|santad|CbDefense|td-agent|packetbeat|filebeat|auditbeat|osqueryd|BlockBlock|LuLu'
```






<br/>
<br/>

## Atomic Test #4 - Security Software Discovery - ps (Linux)
Methods to identify Security Software on an endpoint
when sucessfully executed, command shell  is going to display AV/Security software it is running.

**Supported Platforms:** Linux


**auto_generated_guid:** 23b91cd2-c99c-4002-9e41-317c63e024a2






#### Attack Commands: Run with `sh`! 


```sh
ps aux | egrep 'falcond|nessusd|cbagentd|td-agent|packetbeat|filebeat|auditbeat|osqueryd'
```






<br/>
<br/>

## Atomic Test #5 - Security Software Discovery - Sysmon Service
Discovery of an installed Sysinternals Sysmon service using driver altitude (even if the name is changed).

when sucessfully executed, the test is going to display sysmon driver instance if it is installed.

**Supported Platforms:** Windows


**auto_generated_guid:** fe613cf3-8009-4446-9a0f-bc78a15b66c9






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
fltmc.exe | findstr.exe 385201
```






<br/>
<br/>

## Atomic Test #6 - Security Software Discovery - AV Discovery via WMI
Discovery of installed antivirus products via a WMI query.

when sucessfully executed, the test is going to display installed AV software.

**Supported Platforms:** Windows


**auto_generated_guid:** 1553252f-14ea-4d3b-8a08-d7a4211aa945






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
wmic.exe /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
```






<br/>
