T1518.001 Security Software Discovery — Detection Rules

Source-backed rule directory

• Security Software Discovery - Linux · test · low · {"category":"process_creation","product":"linux"}
• System Integrity Protection (SIP) Disabled · test · medium · {"product":"macos","category":"process_creation"}
• System Integrity Protection (SIP) Enumeration · test · low · {"product":"macos","category":"process_creation"}
• Security Software Discovery - MacOs · test · medium · {"category":"process_creation","product":"macos"}
• Security Software Discovery Via Powershell Script · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Security Tools Keyword Lookup Via Findstr.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1518.001 Security Software Discovery

MATCH(command_queries_security_products_or_services) -> ALERT

• Process Execution Logs
• Endpoint Detection and Response Telemetry
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0016 Security Software Discovery Across Platforms

AN0048 Analytic 0048

Adversary executes commands to enumerate installed antivirus, EDR, or firewall agents using WMI, registry queries, and built-in tools (e.g., tasklist, netsh, sc query). Correlated with elevated process privileges or scripting engine usage.

AN0049 Analytic 0049

Adversary runs discovery commands such as `ps aux`, `systemctl status`, or `cat /etc/init.d/` to enumerate security software or services. Often occurs alongside privilege escalation or bash script execution.

AN0050 Analytic 0050

Adversary attempts to detect monitoring agents such as Little Snitch, KnockKnock, or other system daemons via process listing (`ps -e`), application folder checks, and system extension listing.