# Security Software Discovery

Security Software Discovery
Technique
ID T1063
Tactic Discovery
Platform Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1, Windows 10, MacOS, OS X
Data Sources File monitoring, Process command-line parameters, Process monitoring

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules, anti-virus, and virtualization. These checks may be built into early-stage remote access tools.

## Contents

### Windows

Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.

### Mac

It's becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.

## Examples

• Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.1
• Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).2
• CHOPSTICK checks for anti-virus, forensics, and virtualization software.3
• The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit. Newer versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit. 4
• Crimson contains a command to collect information about anti-virus software on the victim.5
• DustySky checks for the existence of anti-virus.6
• The Dyre crimeware toolkit has refined its detection of sandbox analysis environments by inspecting the process list and Registry.7
• Flame identifies security software such as antivirus through the Security module.8
• Kasidet has the ability to identify any anti-virus installed on the infected system.9
• A module in Prikormka collects information from the victim about installed anti-virus software.10
• RTM can obtain information about security software on the victim.11
• Remsec has a plugin to detect active drivers of some security products.12
• StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.13
• T9000 performs checks for various antivirus and security products during installation.14
• Tasklist can be used to enumerate security software currently running on a system by process name of known products.15
• netsh can be used to discover system firewall settings.16

## Mitigation

Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about local security software, and audit and/or block them by using whitelisting17 tools, like AppLocker,1819 or Software Restriction Policies20 where appropriate.21

## Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.