value:  CHOPSTICK checks for antivirus and forensics software. ;; Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine. ;; Comnie attempts to detect several anti-virus products. ;; CookieMiner has checked for the presence of Little Snitch" macOS network monitoring and application firewall software stopping and exiting if it is found. ;; The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list the dropper will exit. ;; Crimson contains a command to collect information about anti-virus software on the victim. ;; Darkhotel has searched for anti-malware strings and anti-virus processes running on the system. ;; down_new has the ability to detect anti-virus products and processes on a compromised host. ;; DustySky checks for the existence of anti-virus. ;; Empire can enumerate antivirus software on the target. ;; Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them. ;; EvilBunny has been observed querying installed antivirus software. ;; EVILNUM can search for anti-virus products on the system. ;; Felismus checks for processes associated with anti-virus vendors. ;; FELIXROOT checks for installed security software like antivirus and firewall. ;; FIN8 has used Registry keys to detect and avoid executing in potential sandboxes. ;; FinFisher probes the system to check for antimalware processes. ;; Flame identifies security software such as antivirus through the Security module. ;; FlawedAmmyy will attempt to detect anti-virus products during the initial infection. ;; Frankenstein has used WMI queries to detect if virtualization environments or analysis tools were running on the system. ;; Gold Dragon checks for anti-malware products and processes. ;; Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections. ;; InvisiMole can check for the presence of network sniffers AV and BitDefender firewall. ;; JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them. ;; jRAT can list security software such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details. ;; Kasidet has the ability to identify any anti-virus installed on the infected system. ;; Metamorfo collects a list of installed antivirus software from the victim’s system. ;; Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI. ;; MoleNet can use WMI commands to check the system for firewall and antivirus software. ;; More_eggs can obtain information on installed anti-malware programs. ;; Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system. ;; MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers. ;; Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings. ;; netsh can be used to discover system firewall settings. ;; Netwalker can detect and terminate active security software-related processes on infected systems. ;; NotPetya determines if specific antivirus programs are running on an infected host machine. ;; Operation Wocao has used scripts to detect security software. ;; Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool). ;; PipeMon can check for the presence of ESET and Kaspersky security software. ;; POWERSTATS has detected security tools. ;; POWRUNER may collect information on the victim's anti-virus software. ;; A module in Prikormka collects information from the victim about installed anti-virus software. ;; PUNCHBUGGY can gather AVs registered in the system. ;; Remsec has a plugin to detect active drivers of some security products. ;; Rocke used scripts which detected and uninstalled antivirus software. ;; RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite. ;; ROKRAT checks for debugging tools. ;; RTM can obtain information about security software on the victim. ;; Sidewinder has used the Windows service winmgmts:\.\root\SecurityCenter2 to check installed antivirus products. ;; Skidmap has the ability to check if /usr/sbin/setenforce exists. This file controls what mode SELinux is in. ;; StoneDrill can check for antivirus and antimalware programs. ;; StreamEx has the ability to scan for security tools such as firewalls and antivirus tools. ;; StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload. ;; SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution. ;; T9000 performs checks for various antivirus and security products during installation. ;; TajMahal has the ability to identify which anti-virus products firewalls and anti-spyware products are in use. ;; Tasklist can be used to enumerate security software currently running on a system by process name of known products. ;; The White Company has checked for specific antivirus products on the target’s computer including Kaspersky Quick Heal AVG BitDefender Avira Sophos Avast! and ESET. ;; ThiefQuest uses the kill_unwanted function to get a list of running processes compares each process with an encrypted list of “unwanted” security related programs and kills the processes for security related programs. ;; Tropic Trooper can search for anti-virus software running on the system. ;; Turla has obtained information on security software including security logging information that may indicate whether their malware has been detected. ;; Valak can determine if a compromised host has security products installed. ;; VERMIN uses WMI to check for anti-virus software installed on the system. ;; Waterbear can find the presence of a specific security software. ;; Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools. ;; Wingbird checks for the presence of Bitdefender security software. ;; Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine. ;; YAHOYAH checks for antimalware solution processes on the system. ;; Zeus Panda checks to see if anti-virus anti-spyware or firewall products are installed in the victim’s environment."
name: Software Discovery: Security Software Discovery