Antivirus and EDR agents enumerated from the command line

Siemphony@siemphonylowT1518.001unverified

Matches MITRE's AN0048 in the form a single process-creation record can carry: a command line naming the Windows Security Center WMI classes, a Defender status cmdlet, a firewall-profile dump, or one of the enumeration tools carrying the name of a security agent. The first three arms need no tool gate because those class and cmdlet names appear nowhere else, while the vendor arm is gated on the enumeration tool because a product name on its own turns up in ordinary paths all day; the vendor and service names are the author's population of MITRE's ImagePathContains knob, not MITRE's list. It shares its shape with the published T1518.002 rule for backup-software discovery, but the value lists are disjoint and the three ungated arms have no equivalent there. This category is fed here by Security EventID 4688, which needs Audit Process Creation and the separate policy that includes the command line in the event — every arm of this rule reads CommandLine, so without that second policy it matches nothing at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0016, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "securitycenter2" or ProcessCommandLine contains "AntiVirusProduct" or ProcessCommandLine contains "AntiSpywareProduct" or ProcessCommandLine contains "FirewallProduct") or (ProcessCommandLine contains "Get-MpComputerStatus" or ProcessCommandLine contains "Get-MpPreference" or ProcessCommandLine contains "Get-MpThreat") or (FolderPath endswith "\\netsh.exe" and ProcessCommandLine contains "firewall show") or ((FolderPath endswith "\\tasklist.exe" or FolderPath endswith "\\sc.exe" or FolderPath endswith "\\reg.exe" or FolderPath endswith "\\findstr.exe" or FolderPath endswith "\\wmic.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "windefend" or ProcessCommandLine contains "msmpeng" or ProcessCommandLine contains "crowdstrike" or ProcessCommandLine contains "csfalcon" or ProcessCommandLine contains "sentinelone" or ProcessCommandLine contains "sentinelagent" or ProcessCommandLine contains "carbonblack" or ProcessCommandLine contains "cbdefense" or ProcessCommandLine contains "cylance" or ProcessCommandLine contains "cybereason" or ProcessCommandLine contains "sophos" or ProcessCommandLine contains "symantec" or ProcessCommandLine contains "mcafee" or ProcessCommandLine contains "kaspersky" or ProcessCommandLine contains "trendmicro" or ProcessCommandLine contains "tanium")))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*securitycenter2*" OR CommandLine="*AntiVirusProduct*" OR CommandLine="*AntiSpywareProduct*" OR CommandLine="*FirewallProduct*") OR (CommandLine="*Get-MpComputerStatus*" OR CommandLine="*Get-MpPreference*" OR CommandLine="*Get-MpThreat*") OR (Image="*\\netsh.exe" AND CommandLine="*firewall show*") OR ((Image="*\\tasklist.exe" OR Image="*\\sc.exe" OR Image="*\\reg.exe" OR Image="*\\findstr.exe" OR Image="*\\wmic.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*windefend*" OR CommandLine="*msmpeng*" OR CommandLine="*crowdstrike*" OR CommandLine="*csfalcon*" OR CommandLine="*sentinelone*" OR CommandLine="*sentinelagent*" OR CommandLine="*carbonblack*" OR CommandLine="*cbdefense*" OR CommandLine="*cylance*" OR CommandLine="*cybereason*" OR CommandLine="*sophos*" OR CommandLine="*symantec*" OR CommandLine="*mcafee*" OR CommandLine="*kaspersky*" OR CommandLine="*trendmicro*" OR CommandLine="*tanium*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*securitycenter2*" OR TO_LOWER(process.command_line) LIKE "*antivirusproduct*" OR TO_LOWER(process.command_line) LIKE "*antispywareproduct*" OR TO_LOWER(process.command_line) LIKE "*firewallproduct*") OR (TO_LOWER(process.command_line) LIKE "*get-mpcomputerstatus*" OR TO_LOWER(process.command_line) LIKE "*get-mppreference*" OR TO_LOWER(process.command_line) LIKE "*get-mpthreat*") OR (TO_LOWER(process.executable) LIKE "*\\\\netsh.exe" AND TO_LOWER(process.command_line) LIKE "*firewall show*") OR ((TO_LOWER(process.executable) LIKE "*\\\\tasklist.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sc.exe" OR TO_LOWER(process.executable) LIKE "*\\\\reg.exe" OR TO_LOWER(process.executable) LIKE "*\\\\findstr.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*windefend*" OR TO_LOWER(process.command_line) LIKE "*msmpeng*" OR TO_LOWER(process.command_line) LIKE "*crowdstrike*" OR TO_LOWER(process.command_line) LIKE "*csfalcon*" OR TO_LOWER(process.command_line) LIKE "*sentinelone*" OR TO_LOWER(process.command_line) LIKE "*sentinelagent*" OR TO_LOWER(process.command_line) LIKE "*carbonblack*" OR TO_LOWER(process.command_line) LIKE "*cbdefense*" OR TO_LOWER(process.command_line) LIKE "*cylance*" OR TO_LOWER(process.command_line) LIKE "*cybereason*" OR TO_LOWER(process.command_line) LIKE "*sophos*" OR TO_LOWER(process.command_line) LIKE "*symantec*" OR TO_LOWER(process.command_line) LIKE "*mcafee*" OR TO_LOWER(process.command_line) LIKE "*kaspersky*" OR TO_LOWER(process.command_line) LIKE "*trendmicro*" OR TO_LOWER(process.command_line) LIKE "*tanium*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 4 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(securitycenter2|AntiVirusProduct|AntiSpywareProduct|FirewallProduct)</field>    <description>Antivirus and EDR agents enumerated from the command line (1/4)</description>    <mitre>      <id>T1518.001</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Get-MpComputerStatus|Get-MpPreference|Get-MpThreat)</field>    <description>Antivirus and EDR agents enumerated from the command line (2/4)</description>    <mitre>      <id>T1518.001</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\netsh\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)firewall show</field>    <description>Antivirus and EDR agents enumerated from the command line (3/4)</description>    <mitre>      <id>T1518.001</id>    </mitre>  </rule>   <rule id="100003" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\tasklist\.exe$|\\sc\.exe$|\\reg\.exe$|\\findstr\.exe$|\\wmic\.exe$|\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(windefend|msmpeng|crowdstrike|csfalcon|sentinelone|sentinelagent|carbonblack|cbdefense|cylance|cybereason|sophos|symantec|mcafee|kaspersky|trendmicro|tanium)</field>    <description>Antivirus and EDR agents enumerated from the command line (4/4)</description>    <mitre>      <id>T1518.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d4c5a372-3753-46c3-b4d5-75d49d6f22d4

ATT&CKT1518.001

T1518.001Security Software Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

AN0048 describes commands that enumerate installed antivirus, EDR or firewall agents via WMI, registry queries or built-ins, "correlated with elevated process privileges or scripting engine usage." This rule implements only the enumeration half: four OR-ed selections over a single process-creation record. The privilege/scripting-engine correlation is dropped entirely — nothing here checks who ran the command or from what integrity level.

02 · Telemetry you need

The logsource is category: process_creation, product: windows, and every arm reads CommandLine; two arms also read Image. That is Sysmon EventID 1 vocabulary. The description says the rule is "fed here by Security EventID 4688," but 4688 carries NewProcessName, not Image — translations.json confirms this split: the Splunk and Elastic renderings substitute Image for the Sentinel query's NewProcessName without comment. On a raw 4688 feed with no field mapping, selection_firewall_dump and selection_agent_name — the two arms carrying all sixteen vendor names — match nothing; only the two CommandLine-only arms fire. State the mapping requirement before pointing a reader at 4688 auditing, the way the sibling T1218.012 rule does.

03 · How the logic works

Four selections, condition: 1 of selection* — pure OR, no aggregation. selection_securitycenter matches CommandLine|contains against securitycenter2, AntiVirusProduct, AntiSpywareProduct, FirewallProduct — WMI class names specific enough to need no tool gate. selection_defender_cmdlet matches Get-MpComputerStatus, Get-MpPreference, Get-MpThreat the same way. selection_firewall_dump pairs Image|endswith: '\netsh.exe' with CommandLine|contains: 'firewall show'. selection_agent_name pairs a seven-tool Image|endswith list (tasklist.exe, sc.exe, reg.exe, findstr.exe, wmic.exe, powershell.exe, pwsh.exe) with a sixteen-vendor CommandLine|contains list (windefend, crowdstrike, sentinelone, sophos, mcafee, and so on). Of AN0048's two knobs, only ImagePathContains is implemented — as the tool list plus vendor list in selection_agent_name — and the description says plainly that the vendor and service names are the author's population of that knob, not MITRE's. ParentProcess, the other knob, has no corresponding filter anywhere in the rule.

04 · Common false positives

The review flags selection_agent_name as the loudest arm: the vendor substrings are unanchored against the whole command line, and Tanium in particular runs PowerShell sensors out of C:\Program Files (x86)\Tanium\... continuously on every managed endpoint — the script path alone satisfies the match with zero enumeration behaviour. The rule's own fourth false-positive entry names this mechanism but, per the review, does so as a description of matching logic rather than a named benign source; it mirrors a defect already present in the published T1518.002 rule. The review also names a missed false positive the rule doesn't mention: third-party installer pre-install compatibility checks that query sc or the SecurityCenter2 WMI class for a conflicting product, which fire fleet-wide on patch day. Evasion is trivial — enumerate with tasklist or Get-Process alone and match vendor names inside the implant instead of the command line, and every arm is bypassed.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line; the field-vocabulary mismatch with 4688 was only caught by adversarial review, not by any execution.
tier_2: run read-only against Sysmon EID 1 for a fortnight, rank hits by `Image` and by which vendor substring matched, and expect Tanium- or agent-hosted PowerShell paths near the top.
tier_3: ** add the ParentProcess filter and correlate enumeration hits with elevated integrity level or scripting-engine usage, turning a bare command-line match into the correlated signal AN0048 actually specifies.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

State the field-vocabulary requirement explicitly before citing 4688: either run this against Sysmon EID 1, or map NewProcessName to Image first. Rewrite the fourth false-positive entry as a named source — agent-installed PowerShell scripts running from the vendor's own install path — rather than a restatement of the match logic. Anchor the vendor terms to a query verb, or add a filter excluding each vendor's own install directory, so selection_agent_name survives contact with an estate that runs that product. Build the dropped ParentProcess knob and the elevated-privilege correlation AN0048 describes as a companion rule rather than widening this one.

Declared by the author

Endpoint management, asset inventory and compliance tooling. Configuration-management agents and vulnerability scanners call the Defender status cmdlets, dump firewall profiles with netsh and query agent services with sc on a fixed schedule, and on a managed fleet that is the rule's dominant volume by a wide margin.
The security products themselves. Antivirus, EDR and firewall agents run their own health checks through these same cmdlets and WMI classes, and their installers query the Security Center classes in order to register the product with Windows.
Helpdesk and support workflows, where confirming that the antivirus service is running is the first troubleshooting step and uses the same tasklist or sc query command an adversary would type.
The vendor names are unanchored substrings tested against the whole command line, so any powershell.exe or findstr.exe invocation whose script path, log directory or share name contains a product name matches even though no enumeration took place.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1518.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/d4c5a372-3753-46c3-b4d5-75d49d6f22d4

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Antivirus and EDR agents enumerated from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it