Procedure examples

EVILNUM can search for anti-virus products on the system.

Metamorfo collects a list of installed antivirus software from the victim’s system.

PipeMon can check for the presence of ESET and Kaspersky security software.

T9000 performs checks for various antivirus and security products during installation.

MoleNet can use WMI commands to check the system for firewall and antivirus software.

BLUELIGHT can collect a list of anti-virus products installed on a machine.

down_new has the ability to detect anti-virus products and processes on a compromised host.

Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.

RedLine Stealer has identified installed antivirus software on the system.

StoneDrill can check for antivirus and antimalware programs.

RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.

LitePower can identify installed AV software.

StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.

Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.

RTM can obtain information about security software on the victim.

BlackByte Ransomware looks for security software products prior to full execution.

Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.

LiteDuke has the ability to check for the presence of Kaspersky security software.

ZxxZ can search a compromised host to determine if it is running Windows Defender or Kasperky antivirus.

Bazar can identify the installed antivirus engine.

BadPatch uses WMI to enumerate installed security products in the victim’s environment.

HiddenFace can identify processes identified with security applications and tooling.

ABK has the ability to identify the installed anti-virus product on the compromised host.

FinFisher probes the system to check for antimalware processes.

SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.

EvilBunny has been observed querying installed antivirus software.

Wingbird checks for the presence of Bitdefender security software.

Valak can determine if a compromised host has security products installed.

TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.

Gold Dragon checks for anti-malware products and processes.

Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.

FunnyDream can identify the processes for Bkav antivirus.

More_eggs can obtain information on installed anti-malware programs.

Clop can search for processes with antivirus and antimalware product names.

YAHOYAH checks for antimalware solution processes on the system.

CHOPSTICK checks for antivirus and forensics software.

FELIXROOT checks for installed security software like antivirus and firewall.

SPAWNCHIMERA has checked where SELinux is enabled on the targeted host.

build_downer has the ability to detect if the infected host is running an anti-virus process.

Meteor has the ability to search for Kaspersky Antivirus on a victim's machine.

JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.

LunarWeb has run shell commands to obtain a list of installed security products.

XCSSET searches firewall configuration files located in /Library/Preferences/ and uses csrutil status to determine if System Integrity Protection is enabled.

The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit.

POWERSTATS has detected security tools.

Astaroth checks for the presence of Avast antivirus in the C:\Program\Files\ folder.

QakBot can identify the installed antivirus product on a targeted system.

CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.

Gelsemium can check for the presence of specific security products.

jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.