Software Discovery: Security Software Discovery

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.

Adversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.^[1]

ID: T1518.001

Sub-technique of: T1518

Tactic: Discovery

Platforms: AWS, Azure, Azure AD, GCP, Linux, Office 365, SaaS, Windows, macOS

Permissions Required: User

Data Sources: AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs

CAPEC ID: CAPEC-581

Version: 1.1

Created: 21 February 2020

Last Modified: 16 September 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
ABK	ABK has the ability to identify the installed anti-virus product on the compromised host.^[2]
Astaroth	Astaroth checks for the presence of Avast antivirus in the `C:\Program\Files\` folder. ^[3]
Avenger	Avenger has the ability to identify installed anti-virus products on a compromised host.^[2]
BadPatch	BadPatch uses WMI to enumerate installed security products in the victim’s environment.^[4]
build_downer	build_downer has the ability to detect if the infected host is running an anti-virus process.^[2]
Carberp	Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.^[5]
CHOPSTICK	CHOPSTICK checks for antivirus and forensics software.^[6]
Cobalt Group	Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.^[7]
Comnie	Comnie attempts to detect several anti-virus products.^[8]
CookieMiner	CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.^[9]
CozyCar	The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit.^[10]
Crimson	Crimson contains a command to collect information about anti-virus software on the victim.^[11]
Darkhotel	Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.^[12]
down_new	down_new has the ability to detect anti-virus products and processes on a compromised host.^[2]
DustySky	DustySky checks for the existence of anti-virus.^[13]
Empire	Empire can enumerate antivirus software on the target.^[14]
Epic	Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.^[15]
EvilBunny	EvilBunny has been observed querying installed antivirus software.^[16]
Felismus	Felismus checks for processes associated with anti-virus vendors.^[17]
FELIXROOT	FELIXROOT checks for installed security software like antivirus and firewall.^[18]
FIN8	FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.^[19]
FinFisher	FinFisher probes the system to check for antimalware processes.^[20]^[21]
Flame	Flame identifies security software such as antivirus through the Security module.^[22]^[23]
FlawedAmmyy	FlawedAmmyy will attempt to detect anti-virus products during the initial infection.^[24]
Frankenstein	Frankenstein has used WMI queries to detect if virtualization environments or analysis tools were running on the system.^[25]
Gold Dragon	Gold Dragon checks for anti-malware products and processes.^[26]
InvisiMole	InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.^[27]
JPIN	JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.^[28]
jRAT	jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.^[29]^[30]
Kasidet	Kasidet has the ability to identify any anti-virus installed on the infected system.^[31]
Metamorfo	Metamorfo collects a list of installed antivirus software from the victim’s system.^[32]
Micropsia	Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.^[33]^[34]
More_eggs	More_eggs can obtain information on installed anti-malware programs.^[35]
Mosquito	Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.^[36]
MuddyWater	MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.^[37]
Naikon	Naikon uses commands such as `netsh advfirewall firewall` to discover local firewall settings.^[38]
netsh	netsh can be used to discover system firewall settings.^[39]^[40]
Netwalker	Netwalker can detect and terminate active security software-related processes on infected systems.^[41]
Patchwork	Patchwork scanned the "Program Files" directories for a directory with the string "Total Security" (the installation path of the "360 Total Security" antivirus tool).^[42]
PipeMon	PipeMon can check for the presence of ESET and Kaspersky security software.^[43]
POWERSTATS	POWERSTATS has detected security tools.^[44]
POWRUNER	POWRUNER may collect information on the victim's anti-virus software.^[45]
Prikormka	A module in Prikormka collects information from the victim about installed anti-virus software.^[46]
PUNCHBUGGY	PUNCHBUGGY can gather AVs registered in the system.^[47]
Remsec	Remsec has a plugin to detect active drivers of some security products.^[48]
Rocke	Rocke used scripts which detected and uninstalled antivirus software.^[49]^[50]
RogueRobin	RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.^[51]^[52]
ROKRAT	ROKRAT checks for debugging tools.^[53]^[54]
RTM	RTM can obtain information about security software on the victim.^[55]
Skidmap	Skidmap has the ability to check if `/usr/sbin/setenforce` exists. This file controls what mode SELinux is in.^[56]
StoneDrill	StoneDrill can check for antivirus and antimalware programs.^[57]
StreamEx	StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.^[58]
StrongPity	StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.^[59]
Sunburst	Sunburst checked for a variety of antivirus/endpoint detection agents prior to execution.^[60]^[61]
T9000	T9000 performs checks for various antivirus and security products during installation.^[62]
TajMahal	TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.^[63]
Tasklist	Tasklist can be used to enumerate security software currently running on a system by process name of known products.^[64]
The White Company	The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.^[65]
Tropic Trooper	Tropic Trooper can search for anti-virus software running on the system.^[66]
Turla	Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.^[67]
Valak	Valak can determine if a compromised host has security products installed.^[68]
VERMIN	VERMIN uses WMI to check for anti-virus software installed on the system.^[69]
Wingbird	Wingbird checks for the presence of Bitdefender security software.^[70]
Wizard Spider	Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.^[71]
YAHOYAH	YAHOYAH checks for antimalware solution processes on the system.^[72]
Zeus Panda	Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.^[73]^[74]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

In cloud environments, additionally monitor logs for the usage of APIs that may be used to gather information about security software configurations within the environment.

Software Discovery: Security Software Discovery

Procedure Examples

Mitigations

Detection

References