Technique:  Software Discovery:Security Software Discovery
ABK has the ability to identify the installed anti-virus product on the compromised host.
Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List.
Amadey has checked for a variety of antivirus products.
It has identified security software, configurations, defensive tools, and sensors installed on a compromised system.
It has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.
Astaroth checks for the presence of Avast antivirus in the C:\Program\Files\ folder.
AuTo Stealer has the ability to collect information about installed AV products from an infected host.
Avenger has the ability to identify installed anti-virus products on a compromised host.
BadPatch uses WMI to enumerate installed security products in the victim’s environment.
Bazar can identify the installed antivirus engine.
BLUELIGHT can collect a list of anti-virus products installed on a machine.
Brute Ratel C4 can detect EDR userland hooks.
build_downer has the ability to detect if the infected host is running an anti-virus process.
Bumblebee can identify specific analytical tools based on running processes.
Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.
CHOPSTICK checks for antivirus and forensics software.
Clop can search for processes with antivirus and antimalware product names.
It used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.
Comnie attempts to detect several anti-virus products.
CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit.
Crimson contains a command to collect information about anti-virus software on the victim.
It has searched for anti-malware strings and anti-virus processes running on the system.
DarkTortilla can check for the Kaspersky Anti-Virus suite.
DarkWatchman can search for anti-virus products on the system.
down_new has the ability to detect anti-virus products and processes on a compromised host.
DustySky checks for the existence of anti-virus.
Empire can enumerate antivirus software on the target.
Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.
EvilBunny has been observed querying installed antivirus software.
EVILNUM can search for anti-virus products on the system.
Felismus checks for processes associated with anti-virus vendors.
FELIXROOT checks for installed security software like antivirus and firewall.
Ferocious has checked for AV software as part of its persistence process.
It has used Registry keys to detect and avoid executing in potential sandboxes.
FinFisher probes the system to check for antimalware processes.
Flame identifies security software such as antivirus through the Security module.
FlawedAmmyy will attempt to detect anti-virus products during the initial infection.
During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system.
FunnyDream can identify the processes for Bkav antivirus.
Gelsemium can check for the presence of specific security products.
Gold Dragon checks for anti-malware products and processes.
Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.
InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.
JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.
jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.
Kasidet has the ability to identify any anti-virus installed on the infected system.
It has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct.
LiteDuke has the ability to check for the presence of Kaspersky security software.
LitePower can identify installed AV software.
Lizar can search for processes associated with an anti-virus product from list.
Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.
MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.
Metamorfo collects a list of installed antivirus software from the victim’s system.
Meteor has the ability to search for Kaspersky Antivirus on a victim's machine.
Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.
MoleNet can use WMI commands to check the system for firewall and antivirus software.
More_eggs can obtain information on installed anti-malware programs.
Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.
It has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.
It uses commands such as netsh advfirewall firewall to discover local firewall settings.
netsh can be used to discover system firewall settings.
Netwalker can detect and terminate active security software-related processes on infected systems.
NotPetya determines if specific antivirus programs are running on an infected host machine.
During Operation Wocao, threat actors used scripts to detect security software.
Pacu can enumerate AWS security services, including WAF rules and GuardDuty detectors.
It scanned the "Program Files" directories for a directory with the string "Total Security" (the installation path of the "360 Total Security" antivirus tool).
PipeMon can check for the presence of ESET and Kaspersky security software.
POWERSTATS has detected security tools.
POWRUNER may collect information on the victim's anti-virus software.
A module in Prikormka collects information from the victim about installed anti-virus software.
PUNCHBUGGY can gather AVs registered in the system.
QakBot can identify the installed antivirus product on a targeted system.
Remsec has a plugin detect security products via active drivers.
It used scripts which detected and uninstalled antivirus software.
RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.
It can obtain information about security software on the victim.
It uses a loader DLL file to collect AV product names from an infected host.
It has used the Windows service winmgmts:\.\root\SecurityCenter2 to check installed antivirus products.
SILENTTRINITY can determine if an anti-virus product is installed through the resolution of the service's virtual SID.
Skidmap has the ability to check if /usr/sbin/setenforce exists. This file controls what mode SELinux is in.
SpicyOmelette can check for the presence of 29 different antivirus tools.
StoneDrill can check for antivirus and antimalware programs.
StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.
StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.
Stuxnet enumerates the currently running processes related to a variety of security products.
SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.
T9000 performs checks for various antivirus and security products during installation.
It has used tools to search victim systems for security products such as antivirus and firewall software.
TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.
Tasklist can be used to enumerate security software currently running on a system by process name of known products.
It has searched for security products on infected machines.
It has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.
ThiefQuest uses the kill_unwanted function to get a list of running processes, compares each process with an encrypted list of "unwanted" security related programs, and kills the processes for security related programs.
It can search for anti-virus software running on the system.
It has obtained information on security software, including security logging information that may indicate whether their malware has been detected.
Valak can determine if a compromised host has security products installed.
VERMIN uses WMI to check for anti-virus software installed on the system.
Waterbear can find the presence of a specific security software.
WhisperGate can recognize the presence of monitoring tools on a target system.
It has used malware to identify installed AV and commonly used forensic and malware analysis tools.
Wingbird checks for the presence of Bitdefender security software.
It has used WMI to identify anti-virus products installed on a victim's machine.
Woody RAT can detect Avast Software, Doctor Web, Kaspersky, AVG, ESET, and Sophos antivirus programs.
xCaon has checked for the existence of Kaspersky antivirus software on the system.
XCSSET searches firewall configuration files located in /Library/Preferences/ and uses csrutil status to determine if System Integrity Protection is enabled.
YAHOYAH checks for antimalware solution processes on the system.
Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.
ZxxZ can search a compromised host to determine if it is running Windows Defender or Kasperky antivirus.