What is security-software discovery?¶
Security-software discovery is activity used to identify antivirus, endpoint detection, monitoring, logging or other defensive tools.
Avoid the dangerous assumption¶
The dangerous assumption is that any query about security software proves an offender was preparing to evade detection.
It may not.
Installers, support tools, administrators and asset-management products may gather the same information.
An offender may seek to learn:
- which security products are installed
- whether sensors are active
- what processes belong to security tools
- what exclusions exist
- whether logging is enabled
- which controls may block later activity.
Evidence may include:
- process listings
- service queries
- registry or configuration access
- installed-software inventory
- command history
- security alerts
- scripts
- subsequent tool tampering.
Investigators should establish the account, process, time and source of the query.
One isolated inventory command may be routine.
A sequence involving security discovery followed by disabling or bypass activity is more significant.
Do not assume that discovering a security tool means it was successfully evaded.
Likewise, the absence of a later alert may reflect coverage or retention gaps rather than deliberate evasion.
Preserve both the discovery activity and any later changes to security controls.
Where a security product identifies the query itself, obtain the underlying command and process evidence. The product label may group inventory activity, defence evasion and later tampering into one alert even though they are separate events.
The distinction between discovery and tampering must remain visible in the timeline.
Operational takeaway¶
Assess security-software discovery in sequence with later tampering or evasion, and do not treat the information query alone as proof of malicious intent.