T1518.001: T1518.001

216.73.216.6

View on MITRE ATT&CK The MITRE Corporation · Published 21/02/2020 22:16 · Modified 27/03/2026 01:11

Essential information

MITRE technique ID: T1518.001
Confidence: 100/100
Revoked: No
Published: 21/02/2020 22:16
Modified: 27/03/2026 01:11
Author / Source: The MITRE Corporation

Aliases

Security Software Discovery

Platforms

windows macos linux IaaS

Description

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.

Kill chain phases

Kill chain	Phase
mitre-attack	discovery

Marking (TLP)

External references

mitre-attack (T1518.001)