T1518.001 — Security Software Discovery

Tactic: Discovery · Platforms: IaaS, Linux, macOS, Windows

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software…

Sub-technique of Software Discovery (T1518).

Sigma detection rules (3)

title: "T1518.001 Software Discovery: Security Software Discovery"
id: d10db47d-acfc-4a7c-b654-3d4abcf40736
description: 'Detects Security Software Discovery via process creation events - tasklist or wmic invocations whose command line references antivirus/EDR product or process names. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentProcess, ImagePathContains.'
references:
  - https://attack.mitre.org/techniques/T1518/001
author: Shahrukh Khan
date: 2026-04-12
license: MIT
tags:
  - attack.discovery
  - attack.t1518.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '1'
    Image|endswith:
      - '\tasklist.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'antivirus'
      - 'MsMpEng'
      - 'CSFalconService'

  condition: selection

falsepositives:
  - Legitimate IT/security audit tooling checking installed security products.

level: informational

title: "T1518.001 Software Discovery: Security Software Discovery"
id: 4c51cfd9-0f4f-4721-91fd-8e02d0416c1f
description: 'Security Software Discovery Across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Removed the standalone "ps aux" branch from the condition since it alone is extremely common and low-signal; the rule now only fires on the specific grep-for-known-security-tool-name indicator. Tune using: ExecutableName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1518/001
author: Shahrukh Khan
date: 2026-06-13
license: MIT
tags:
  - attack.discovery
  - attack.t1518.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_grep:
    type: EXECVE
    exe|endswith: '/grep'
    a1|contains:
      - 'falco'
      - 'auditd'
      - 'wazuh'
      - 'crowdstrike'

  condition: selection_grep

falsepositives:
  - Sysadmins or automated health-check scripts occasionally grep process listings for these specific security-tool names during troubleshooting; still a comparatively rare, specific string search worth reviewing.

level: low

title: "T1518.001 Software Discovery: Security Software Discovery"
id: 612dcb8c-abb2-4d4b-8982-6bc3107cac27
description: 'Security Software Discovery Across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ToolNameMatch.'
references:
  - https://attack.mitre.org/techniques/T1518/001
author: Shahrukh Khan
date: 2026-04-02
license: MIT
tags:
  - attack.discovery
  - attack.t1518.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/systemctl'
    a1|contains|all:
      - 'status'
    a2|contains:
      - 'falco'
      - 'auditd'
      - 'wazuh-agent'

  condition: selection

falsepositives:
  - Routine security-tooling health checks by admins; this second variant is scoped specifically to systemctl status queries against known agent unit names, a slightly stronger signal than a bare ps aux.

level: informational

Related sub-techniques

• T1518.002 Backup Software Discovery

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1518.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan