T1518.001 Security Software Discovery
Sub-technique of T1518 Software Discovery
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Sysmon Discovery Via Default Driver Altitude Using Findstr.EXEhightest · windows
- Security Software Discovery - MacOsmediumtest · macos
- Security Software Discovery Via Powershell Scriptmediumtest · windows
- Security Tools Keyword Lookup Via Findstr.EXEmediumtest · windows
- System Integrity Protection (SIP) Disabledmediumtest · macos
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.