T1063.md

T1063 - Security Software Discovery

Description from ATT&CK

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules and anti-virus. These checks may be built into early-stage remote access tools.

Windows

Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.

Mac

It's becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.

Atomic Tests

• Atomic Test #1 - Security Software Discovery

• Atomic Test #2 - Security Software Discovery - powershell

• Atomic Test #3 - Security Software Discovery - ps

• Atomic Test #4 - Security Software Discovery - Sysmon Service

Atomic Test #1 - Security Software Discovery

Methods to identify Security Software on an endpoint

Supported Platforms: Windows

Run it with command_prompt!

netsh.exe advfirewall firewall show all profiles
tasklist.exe
tasklist.exe | findstr /i virus
tasklist.exe | findstr /i cb
tasklist.exe | findstr /i defender
tasklist.exe | findstr /i cylance

Atomic Test #2 - Security Software Discovery - powershell

Methods to identify Security Software on an endpoint

Supported Platforms: Windows

Run it with powershell!

get-process | ?{$_.Description -like "*virus*"}
get-process | ?{$_.Description -like "*carbonblack*"}
get-process | ?{$_.Description -like "*defender*"}
get-process | ?{$_.Description -like "*cylance*"}

Atomic Test #3 - Security Software Discovery - ps

Methods to identify Security Software on an endpoint

Supported Platforms: Linux, macOS

Run it with sh!

ps -ef | grep Little\ Snitch | grep -v grep
ps aux | grep CbOsxSensorService

Atomic Test #4 - Security Software Discovery - Sysmon Service

Discovery of an installed Sysinternals Sysmon service using driver altitude (even if the name is changed).

Supported Platforms: Windows

Run it with command_prompt! Elevation Required (e.g. root or admin)

fltmc.exe | findstr.exe 385201