Procedure examples

LiteDuke has the ability to check for the presence of Kaspersky security software.

ZxxZ can search a compromised host to determine if it is running Windows Defender or Kasperky antivirus.

Bazar can identify the installed antivirus engine.

BadPatch uses WMI to enumerate installed security products in the victim’s environment.

HiddenFace can identify processes identified with security applications and tooling.

ABK has the ability to identify the installed anti-virus product on the compromised host.

FinFisher probes the system to check for antimalware processes.

SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.

EvilBunny has been observed querying installed antivirus software.

Wingbird checks for the presence of Bitdefender security software.

Valak can determine if a compromised host has security products installed.

TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.

Gold Dragon checks for anti-malware products and processes.

Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.

FunnyDream can identify the processes for Bkav antivirus.

More_eggs can obtain information on installed anti-malware programs.

Clop can search for processes with antivirus and antimalware product names.

YAHOYAH checks for antimalware solution processes on the system.

CHOPSTICK checks for antivirus and forensics software.

FELIXROOT checks for installed security software like antivirus and firewall.

SPAWNCHIMERA has checked where SELinux is enabled on the targeted host.

build_downer has the ability to detect if the infected host is running an anti-virus process.

Meteor has the ability to search for Kaspersky Antivirus on a victim's machine.

JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.

LunarWeb has run shell commands to obtain a list of installed security products.

XCSSET searches firewall configuration files located in /Library/Preferences/ and uses csrutil status to determine if System Integrity Protection is enabled.

The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit.

POWERSTATS has detected security tools.

Astaroth checks for the presence of Avast antivirus in the C:\Program\Files\ folder.

QakBot can identify the installed antivirus product on a targeted system.

CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.

Gelsemium can check for the presence of specific security products.

jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.

SplatCloak has identified drivers of AV solutions by searching for related filenames, keywords and signed certificates.

Waterbear can find the presence of a specific security software.

Comnie attempts to detect several anti-virus products.

Lizar can search for processes associated with an anti-virus product from list.

SILENTTRINITY can determine if an anti-virus product is installed through the resolution of the service's virtual SID.

Pacu can enumerate AWS security services, including WAF rules and GuardDuty detectors.

Tasklist can be used to enumerate security software currently running on a system by process name of known products.

Empire can enumerate antivirus software on the target.

netsh can be used to discover system firewall settings.

Brute Ratel C4 can detect EDR userland hooks.

Flame identifies security software such as antivirus through the Security module.

Pacu can enumerate AWS services, such as CloudTrail and CloudWatch.

AADInternals can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations.

ROADTools can enumerate Azure AD applications and service principals.

TruffleHog has the ability to scan code repositories and CI/CD platforms.

TeamPCP Cloud Stealer can search GitHub for Actions runner processes.

Shai-Hulud has stolen access tokens and API tokens from with CI/CD pipeline solutions and repositories.