Security Software Discovery

From enterprise
Jump to: navigation, search
Security Software Discovery
ID T1063
Tactic Discovery
Platform macOS, Windows
Permissions Required User, Administrator, SYSTEM
Data Sources File monitoring, Process command-line parameters, Process monitoring

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules, anti-virus, and virtualization. These checks may be built into early-stage remote access tools.


Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.


It's becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.


  • Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.1
  • Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).2
  • CHOPSTICK checks for anti-virus, forensics, and virtualization software.3
  • The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit. Newer versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit. 4
  • Crimson contains a command to collect information about anti-virus software on the victim.5
  • DustySky checks for the existence of anti-virus.6
  • The Dyre crimeware toolkit has refined its detection of sandbox analysis environments by inspecting the process list and Registry.7
  • Felismus checks for processes associated with anti-virus vendors.8
  • Flame identifies security software such as antivirus through the Security module.9
  • Kasidet has the ability to identify any anti-virus installed on the infected system.10
  • POWRUNER may collect information the victim's anti-virus software.11
  • A module in Prikormka collects information from the victim about installed anti-virus software.12
  • RTM can obtain information about security software on the victim.13
  • Remsec has a plugin to detect active drivers of some security products.14
  • StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.15
  • T9000 performs checks for various antivirus and security products during installation.16
  • Tasklist can be used to enumerate security software currently running on a system by process name of known products.17
  • Wingbird checks for the presence of Bitdefender security software.18
  • netsh can be used to discover system firewall settings.19


Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about local security software, and audit and/or block them by using whitelisting20 tools, like AppLocker,2122 or Software Restriction Policies23 where appropriate.24


System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.