AN0048
Analytic 0048
Windows
Adversary executes commands to enumerate installed antivirus, EDR, or firewall agents using WMI, registry queries, and built-in tools (e.g., tasklist, netsh, sc query). Correlated with elevated process privileges or scripting engine usage.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=7
[ParentProcess]
Defenders can tune based on trusted or known-good parent process relationships
[ImagePathContains]
Regex match on adversary tool or enumeration script used
AN0049
Analytic 0049
Linux
Adversary runs discovery commands such as `ps aux`, `systemctl status`, or `cat /etc/init.d/` to enumerate security software or services. Often occurs alongside privilege escalation or bash script execution.
auditd:SYSCALL
execve
[ExecutableName]
Adjust for custom script names or wrappers used in the environment
[TimeWindow]
Tuning threshold for multiple enumeration commands within short duration
AN0050
Analytic 0050
macOS
Adversary attempts to detect monitoring agents such as Little Snitch, KnockKnock, or other system daemons via process listing (`ps -e`), application folder checks, and system extension listing.
macos:unifiedlog
execution of security-agent detection or enumeration commands
auditd:SYSCALL
execve
[ToolNameMatch]
Adversary may search for specific software names; defenders can tune based on local deployments