// MITRE ATT&CK
T1518.001 · Security Software Discovery
Sub-technique of T1518 · Software Discovery.
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Di...
How to detect & mitigate it
Detecting Security Software Discovery starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1033
System Owner/User Discovery T1613
Container and Resource Discovery T1016.001
Internet Connection Discovery T1069
Permission Groups Discovery T1069.003
Cloud Groups T1615
Group Policy Discovery T1652
Device Driver Discovery T1087.002
Domain Account
System Owner/User Discovery T1613
Container and Resource Discovery T1016.001
Internet Connection Discovery T1069
Permission Groups Discovery T1069.003
Cloud Groups T1615
Group Policy Discovery T1652
Device Driver Discovery T1087.002
Domain Account
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.