T1518.001 Security Software Discovery — Attack Simulation

Technique description

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

• Security Software Discovery - AV Discovery via Get-CimInstance and Get-WmiObject cmdlets
  windowsautomatedcommand_prompt

  Procedure 015cd268-996e-4c32-8347-94c80c6286ee; elevation required; cleanup not declared. Not executed or individually validated.

• Security Software Discovery - AV Discovery via WMI
  windowsautomatedcommand_prompt

  Procedure 1553252f-14ea-4d3b-8a08-d7a4211aa945; elevation required; cleanup not declared. Not executed or individually validated.

• Security Software Discovery - ps (Linux)
  linuxautomatedsh

  Procedure 23b91cd2-c99c-4002-9e41-317c63e024a2; elevation not declared required; cleanup not declared. Not executed or individually validated.

• Security Software Discovery - powershell
  windowsautomatedpowershell

  Procedure 7f566051-f033-49fb-89de-b6bacab730f0; elevation not declared required; cleanup not declared. Not executed or individually validated.

• Enumerate Windows Defender exclusion paths via MpCmdRun.exe
  windowsautomatedpowershell

  Procedure 8eb337ee-fa17-4da7-890a-0204ea470718; elevation not declared required; cleanup not declared. Not executed or individually validated.

• Security Software Discovery - Windows Firewall Enumeration
  windowsautomatedpowershell

  Procedure 9dca5a1d-f78c-4a8d-accb-d6de67cfed6b; elevation required; cleanup not declared. Not executed or individually validated.

• Security Software Discovery - ps (macOS)
  macosautomatedsh

  Procedure ba62ce11-e820-485f-9c17-6f3c857cd840; elevation not declared required; cleanup not declared. Not executed or individually validated.

• Security Software Discovery - Windows Defender Enumeration
  windowsautomatedpowershell

  Procedure d3415a0e-66ef-429b-acf4-a768876954f6; elevation required; cleanup not declared. Not executed or individually validated.

• Get Windows Defender exclusion settings using WMIC
  windowsautomatedcommand_prompt

  Procedure e31564c8-4c60-40cd-a8f4-9261307e8336; elevation required; cleanup not declared. Not executed or individually validated.

• Security Software Discovery
  windowsautomatedcommand_prompt

  Procedure f92a380f-ced9-491f-b338-95a991418ce2; elevation not declared required; cleanup not declared. Not executed or individually validated.

• Security Software Discovery - pgrep (FreeBSD)
  linuxautomatedsh

  Procedure fa96c21c-5fd6-4428-aa28-51a2fbecdbdc; elevation not declared required; cleanup not declared. Not executed or individually validated.

• Security Software Discovery - Sysmon Service
  windowsautomatedcommand_prompt

  Procedure fe613cf3-8009-4446-9a0f-bc78a15b66c9; elevation required; cleanup not declared. Not executed or individually validated.