Software Discovery: Security Software Discovery

ABK has the ability to identify the installed anti-virus product on the compromised host.^[51]

Astaroth checks for the presence of Avast antivirus in the C:\Program\Files\ folder. ^[41]

Avenger has the ability to identify installed anti-virus products on a compromised host.^[51]

BadPatch uses WMI to enumerate installed security products in the victim’s environment.^[38]

build_downer has the ability to detect if the infected host is running an anti-virus process.^[51]

CHOPSTICK checks for antivirus and forensics software.^[29]

Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.^[56]

Comnie attempts to detect several anti-virus products.^[39]

The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit.^[6]

Crimson contains a command to collect information about anti-virus software on the victim.^[16]

Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.^[59]

down_new has the ability to detect anti-virus products and processes on a compromised host.^[51]

DustySky checks for the existence of anti-virus.^[21]

Empire can enumerate antivirus software on the target.^[5]

Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.^[30]

EvilBunny has been observed querying installed antivirus software.^[46]

Felismus checks for processes associated with anti-virus vendors.^[17]

FELIXROOT checks for installed security software like antivirus and firewall.^[40]

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.^[58]

FinFisher probes the system to check for antimalware processes.^[47][48]

Flame identifies security software such as antivirus through the Security module.^[25][26]

FlawedAmmyy will attempt to detect anti-virus products during the initial infection.^[43]

Frankenstein has used WMI queries to detect if virtualization environments or analysis tools were running on the system.^[62]

Gold Dragon checks for anti-malware products and processes.^[33]

JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.^[15]

jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.^[31][32]

Kasidet has the ability to identify any anti-virus installed on the infected system.^[7]

Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.^[13][14]

More_eggs can obtain information on installed anti-malware programs.^[37]

Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.^[27]

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.^[55]

Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.^[60]

netsh can be used to discover system firewall settings.^[2][3]

Netwalker can detect and terminate active security software-related processes on infected systems.^[49]

Patchwork scanned the "Program Files" directories for a directory with the string "Total Security" (the installation path of the "360 Total Security" antivirus tool).^[54]

POWERSTATS has detected security tools.^[24]

POWRUNER may collect information on the victim's anti-virus software.^[35]

A module in Prikormka collects information from the victim about installed anti-virus software.^[36]

PUNCHBUGGY can gather AVs registered in the system.^[44]

Remsec has a plugin to detect active drivers of some security products.^[28]

Rocke used scripts which detected and uninstalled antivirus software.^[63][64]

RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.^[18][19]

ROKRAT checks for debugging tools.^[8][9]

RTM can obtain information about security software on the victim.^[34]

Skidmap has the ability to check if /usr/sbin/setenforce exists. This file controls what mode SELinux is in.^[53]

StoneDrill can check for antivirus and antimalware programs.^[42]

StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.^[20]

T9000 performs checks for various antivirus and security products during installation.^[23]

TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.^[50]

Tasklist can be used to enumerate security software currently running on a system by process name of known products.^[4]

The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.^[61]

Tropic Trooper can search for anti-virus software running on the system.^[57]

Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.^[65]

Valak can determine if a compromised host has security products installed.^[52]

VERMIN uses WMI to check for anti-virus software installed on the system.^[22]

Wingbird checks for the presence of Bitdefender security software.^[10]

YAHOYAH checks for antimalware solution processes on the system.^[45]

Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.^[11][12]