Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise
Excerpt
S0469 ABK
ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT
Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List . [2]
S1025 Amadey
Amadey has checked for a variety of antivirus products.[3][4]
G0082 APT38
APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.[5][6]
G1044 APT42
APT42 has used Windows Management Instrumentation (WMI) to check for anti-virus products.[7] G0143 Aquatic Panda…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
Mentioned in the excerpt
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
