T1518.001Discovery
Security Software Discovery
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
9 Sigma rules tagged T1518.001Security Software DiscoveryT1518.0019 general rules
- Sysmon Discovery Via Default Driver Altitude Using Findstr.EXEhightest
- Security Software Discovery - MacOsmediumtest
- Security Software Discovery Via Powershell Scriptmediumtest
- Security Tools Keyword Lookup Via Findstr.EXEmediumtest
- System Integrity Protection (SIP) Disabledmediumtest
- Local Firewall Rules Enumeration Via NetFirewallRule Cmdletlowtest
- Security Software Discovery - Linuxlowtest
- System Integrity Protection (SIP) Enumerationlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Security Software Discovery
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.