attack_technique: T1518.001
display_name: 'Software Discovery: Security Software Discovery'
atomic_tests:
- name: Security Software Discovery
  auto_generated_guid: f92a380f-ced9-491f-b338-95a991418ce2
  description: |
    Methods to identify Security Software on an endpoint

    when sucessfully executed, the test is going to display running processes, firewall configuration on network profiles
    and specific security software.
  supported_platforms:
  - windows
  executor:
    command: |
      netsh.exe advfirewall  show allprofiles
      tasklist.exe
      tasklist.exe | findstr /i virus
      tasklist.exe | findstr /i cb
      tasklist.exe | findstr /i defender
      tasklist.exe | findstr /i cylance
    name: command_prompt
- name: Security Software Discovery - powershell
  auto_generated_guid: 7f566051-f033-49fb-89de-b6bacab730f0
  description: |
    Methods to identify Security Software on an endpoint

    when sucessfully executed, powershell is going to processes related AV products if they are running.
  supported_platforms:
  - windows
  executor:
    command: |
      get-process | ?{$_.Description -like "*virus*"}
      get-process | ?{$_.Description -like "*carbonblack*"}
      get-process | ?{$_.Description -like "*defender*"}
      get-process | ?{$_.Description -like "*cylance*"}
    name: powershell
- name: Security Software Discovery - ps (macOS)
  auto_generated_guid: ba62ce11-e820-485f-9c17-6f3c857cd840
  description: |
    Methods to identify Security Software on an endpoint
    when sucessfully executed, command shell  is going to display AV/Security software it is running.
  supported_platforms:
  - macos
  executor:
    command: |
      ps aux | egrep 'Little\ Snitch|CbOsxSensorService|falcond|nessusd|santad|CbDefense|td-agent|packetbeat|filebeat|auditbeat|osqueryd|BlockBlock|LuLu'
    name: sh
- name: Security Software Discovery - ps (Linux)
  auto_generated_guid: 23b91cd2-c99c-4002-9e41-317c63e024a2
  description: |
    Methods to identify Security Software on an endpoint
    when sucessfully executed, command shell  is going to display AV/Security software it is running.
  supported_platforms:
  - linux
  executor:
    command: |
      ps aux | egrep 'falcond|nessusd|cbagentd|td-agent|packetbeat|filebeat|auditbeat|osqueryd'
    name: sh
- name: Security Software Discovery - Sysmon Service
  auto_generated_guid: fe613cf3-8009-4446-9a0f-bc78a15b66c9
  description: |
    Discovery of an installed Sysinternals Sysmon service using driver altitude (even if the name is changed).

    when sucessfully executed, the test is going to display sysmon driver instance if it is installed.
  supported_platforms:
  - windows
  executor:
    command: |
      fltmc.exe | findstr.exe 385201
    name: command_prompt
    elevation_required: true
- name: Security Software Discovery - AV Discovery via WMI
  auto_generated_guid: 1553252f-14ea-4d3b-8a08-d7a4211aa945
  description: |
    Discovery of installed antivirus products via a WMI query.

    when sucessfully executed, the test is going to display installed AV software.
  supported_platforms:
  - windows
  executor:
    command: wmic.exe /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    name: command_prompt
    elevation_required: true
