MITRE ATT&CKsub-technique

T1518.001 Security Software Discovery

Published 2020-02-21 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
IaaS, Linux, macOS, Windows
Version
1.5
Created
2020-02-21

Description

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the Cloud API to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1518 Software Discovery technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (142)

  • S9060 MiniBus software (malware)
  • S9037 RustyWater software (malware)
  • S9032 MuddyViper software (malware)
  • S9023 HiddenFace software (malware)
  • S9024 SPAWNCHIMERA software (malware)
  • S9026 ROAMINGHOUSE software (malware)
  • S9019 PureCrypter software (malware)
  • G1053 Storm-0501 group
  • S1244 Medusa Ransomware software (malware)
  • G1051 Medusa Group group
  • S1240 RedLine Stealer software (malware)
  • S1239 TONESHELL software (malware)
  • S1234 SplatCloak software (malware)
  • S1228 PUBLOAD software (malware)
  • S1213 Lumma Stealer software (malware)
  • G1044 APT42 group
  • S1193 TAMECAT software (malware)
  • S1179 Exbyte software (malware)
  • S1180 BlackByte Ransomware software (malware)
  • G1043 BlackByte group
  • G1040 Play group
  • S1159 DUSTTRAP software (malware)
  • S1160 Latrodectus software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • S1141 LunarWeb software (malware)
  • C0035 KV Botnet Activity campaign
  • S1130 Raspberry Robin software (malware)
  • G1026 Malteiro group
  • S1122 Mispadu software (malware)
  • S1111 DarkGate software (malware)
Show all 142 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-581 Security Software Footprinting attack pattern