CmdID / Techniques / T1518

T1518.001 Software Discovery: Security Software Discovery

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. MITRE ATT&CK

2 programs on CmdID 7 Sigma rules T1518.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1518Software Discovery

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

findstr.exeits Sigma rules wmic.exeExecute

Sigma rules tagged with it

process creation, the highest levels first

highSysmon Discovery Via Default Driver Altitude Using Findstr.EXEfrack113 · Windows

mediumSecurity Software Discovery - MacOsDaniil Yugoslavskiy, oscd.community · macOS

mediumSecurity Tools Keyword Lookup Via Findstr.EXENasreddine Bencherchali (Nextron Systems), frack113, MalGamy (Nextron Systems) · Windows

mediumSystem Integrity Protection (SIP) DisabledJoseliyo Sanchez, @Joseliyo_Jstnk · macOS

lowPowerShell AppLocker Policy Discovery Via Get-AppLockerPolicyTom3306 · Windows

lowSecurity Software Discovery - LinuxDaniil Yugoslavskiy, oscd.community · Linux

lowSystem Integrity Protection (SIP) EnumerationJoseliyo Sanchez, @Joseliyo_Jstnk · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Display the System Integrity Protection status on the page for csrutil

csrutil statusIdentify

Disable the System Integrity Protection on the page for csrutil

csrutil disableIdentify

An example is here when CmdID’s reading of it names T1518.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.