Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1518.001sub-technique of T1518 Software Discovery

Security Software Discovery

IaaS · Linux · macOS · Windowsnothing on this site yetT1518.001 on attack.mitre.org

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Security Software Discovery Across Platforms

  • Adversary executes commands to enumerate installed antivirus, EDR, or firewall agents using WMI, registry queries, and built-in tools (e.g., tasklist, netsh, sc query). Correlated with elevated process privileges or scripting engine usage.
  • Adversary runs discovery commands such as `ps aux`, `systemctl status`, or `cat /etc/init.d/` to enumerate security software or services. Often occurs alongside privilege escalation or bash script execution.
  • Adversary attempts to detect monitoring agents such as Little Snitch, KnockKnock, or other system daemons via process listing (`ps -e`), application folder checks, and system extension listing.

the rest of T1518

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.