Procedure examples

down_new has the ability to gather information on installed applications.

RedLine Stealer can get a list of programs on the victim device.

RTM can scan victim drives to look for specific banking software on the machine to determine next actions.

StrelaStealer variants use COM objects to enumerate installed applications from the "AppsFolder" on victim machines.

Bazar can query the Registry for installed applications.

SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.

The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.

HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.

Samurai can check for the presence and version of the .NET framework.

TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.

Raccoon Stealer is capable of identifying running software on victim machines.

ComRAT can check the victim's default browser to determine which process to inject its communications module into.

LunarWeb can list installed software on compromised systems.

XCSSET uses ps aux with the grep command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.

QakBot can enumerate a list of installed programs.

Dridex has collected a list of installed software on the system.

ShimRatReporter gathered a list of installed software on the infected host.

TeamPCP Cloud Stealer has searched for cryptocurrency wallets on targeted hosts.

KV Botnet Activity involved removal of security tools, as well as other identified IOT malware, from compromised devices.

During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system.

During Operation Wocao, threat actors used scripts to detect security software.

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.

BlackByte enumerated installed security products during operations.

SideCopy uses a loader DLL file to collect AV product names from an infected host.

Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct. Kimsuky has also obtained details on antivirus software through WMI queries using `Win32_OperatingSystem` and `SecurityCenter2.AntiVirusProduct`. Kimsuky has also checked the status of Windows Defender through the use `cmd /s sc query WinDefend`.

Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.

Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.

Gamaredon Group has used PowerShell scripts to identify security software on the victim machine.

TeamTNT has searched for security products on infected machines.

Sidewinder has used the Windows service winmgmts:\\.\root\SecurityCenter2 to check installed antivirus products.

Rocke used scripts which detected and uninstalled antivirus software.

TA2541 has used tools to search victim systems for security products such as antivirus and firewall software.

Tropic Trooper can search for anti-virus software running on the system.

Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.

The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.

Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.

Storm-0501 has detected endpoint security solutions using `sc query sense` and `sc query windefend`.

Medusa Group has detected security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.

Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.

Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.

ToddyCat can determine is Kaspersky software is running on an endpoint by running `cmd /c wmic process where name="avp.exe"`.

Malteiro collects the installed antivirus on the victim machine.

APT42 has used Windows Management Instrumentation (WMI) to check for anti-virus products.

Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.

Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.

Play has used the information-stealing tool Grixba to scan for anti-virus software.

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.

Bumblebee can identify specific analytical tools based on running processes.

Amadey has checked for a variety of antivirus products.