tfMITRE ATT&CK sub-technique

Security Software Discovery T1518.001

sub-technique of T1518 Software Discovery

Tactic: Discovery
Platforms: IaaS, Linux, macOS, Windows
Version: 1.5
Created: 21 February 2020
Last modified: 12 May 2026
Contributor: Isif Ibrahima, Mandiant

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 6%

Threat groups94th percentile · 94% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

111

Tools & malwareTop 3%

Tools & malware97th percentile · 97% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules73rd pct

Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.

Security Software Discovery MITRE reference T1518.001

Top 6%of all ATT&CK techniques for number of groups

27 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Storm-0501G1053 ↗

Has detected endpoint security solutions using sc query sense and sc query windefend.1

created 2025-10-191 reference

Medusa GroupG1051 ↗

Has detected security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.1

created 2025-10-151 reference

APT42G1044 ↗

Has used Windows Management Instrumentation (WMI) to check for anti-virus products.1

created 2025-01-081 reference

BlackByteG1043 ↗

Enumerated installed security products during operations.1

created 2024-12-161 referenceaka Hecamede

PlayG1040 ↗

Has used the information-stealing tool Grixba to scan for anti-virus software.1

created 2024-09-241 reference

MalteiroG1026 ↗

Collects the installed antivirus on the victim machine.1

created 2024-03-131 reference

All 27 groups for this technique · 6 newest in this preview

Offense vs defense T1518.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 0

first rule: 2020 Q4 · 3 of 3 campaigns plotted

Security Software Discovery detection strategy DET0016

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Security Software Discovery Across Platforms

Enterprise

3 platforms

AN0048 · Windows

Adversary executes commands to enumerate installed antivirus, EDR, or firewall agents using WMI, registry queries, and built-in tools (e.g., tasklist, netsh, sc query). Correlated with elevated process privileges or scripting engine usage.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Security	EventCode=4688

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcess	Defenders can tune based on trusted or known-good parent process relationships
ImagePathContains	Regex match on adversary tool or enumeration script used

AN0049 · Linux

Adversary runs discovery commands such as ps aux, systemctl status, or cat /etc/init.d/ to enumerate security software or services. Often occurs alongside privilege escalation or bash script execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutableName	Adjust for custom script names or wrappers used in the environment
TimeWindow	Tuning threshold for multiple enumeration commands within short duration

AN0050 · macOS

Adversary attempts to detect monitoring agents such as Little Snitch, KnockKnock, or other system daemons via process listing (ps -e), application folder checks, and system extension listing.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Command ExecutionDC0064	macos:unifiedlog	execution of security-agent detection or enumeration commands

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ToolNameMatch	Adversary may search for specific software names; defenders can tune based on local deployments

1 analytic

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

Tests12Executorscmd 5 · PowerShell 4 · sh 3Need elevation6 of 12Have prerequisites1Have cleanup0Platformswindows, macos, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Security Software Discovery

windows

cmd

—

Security Software Discovery - powershell

windows

PowerShell

—

Security Software Discovery - ps (macOS)

macos

—

Security Software Discovery - ps (Linux)

linux

—

Security Software Discovery - pgrep (FreeBSD)

linux

—

Security Software Discovery - Sysmon Service

windows

cmd

Required

—

Security Software Discovery - AV Discovery via WMI

windows

cmd

Required

—

Security Software Discovery - AV Discovery via Get-CimInstance and Get-WmiObject cmdlets

windows

cmd

Required

—

Security Software Discovery - Windows Defender Enumeration

windows

PowerShell

Required

—

Security Software Discovery - Windows Firewall Enumeration

windows

PowerShell

Required

—

Get Windows Defender exclusion settings using WMIC

windows

cmd

Required

—

Enumerate Windows Defender exclusion paths via MpCmdRun.exe

windows

PowerShell

—

Determines whether one or more paths are excluded from Microsoft Defender scanning by invoking the signed Microsoft binary MpCmdRun.exe with a custom scan (-ScanType 3) against a deliberately invalid path containing a pipe character. Because Defender evaluates its exclusion list before attempting to scan, an excluded directory reports that scanning "was skipped". This does not require administrative privileges, unlike Get-MpPreference, which returns "N/A: Must be an administrator to view exclusions" for unprivileged users. An adversary can therefore map Defender's blind spots as a low-privileged user in order to select a location in which to stage file-based payloads. Upon successful execution, excluded paths return "was skipped". Reference: https://blog.fndsec.net/2024/10/04/uncovering-exclusion-paths-in-microsoft-defender-a-security-research-insight/

Input arguments

Name	Type	Default	Description
mpcmdrun_path	path	C:\Program Files\Windows Defender\MpCmdRun.exe	Path to the Microsoft Defender command line utility.
exclusion_paths	string	C:\Temp\ARTExclusionTest	Comma-separated directories to check against the Defender exclusion list.

Attack command

"#{exclusion_paths}".Split(",") | ForEach-Object {
  $path = $_.Trim()
  if ($path) {
    & "#{mpcmdrun_path}" -Scan -ScanType 3 -File "$path\|*"
  }
}

Prerequisite

MpCmdRun.exe must be present on the system.

Check

if (Test-Path "#{mpcmdrun_path}") {exit 0} else {exit 1}

Satisfy

Write-Host (
  "MpCmdRun.exe is a native Microsoft Defender component and cannot be installed. " +
  "It is not present at #{mpcmdrun_path}."
)

GUID4906301f-680e-44a6-b1a5-c6bf3037d16e

Tests from Atomic Red Team (MIT licence) · technique definition

Security Software Discovery detections T1518.001

9 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

73rd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs