Detecting Security Product Discovery and Defense Evasion Attempts

Client Profile

A fintech organization operating critical payment processing and customer transaction platforms.

Business Challenge

The client sought improved visibility into attacker reconnaissance techniques commonly observed after an initial compromise. Threat actors frequently attempt to identify installed antivirus, endpoint detection, and firewall products before deploying malware or executing defense-evasion techniques.

Without dedicated monitoring, these reconnaissance activities can occur unnoticed during the early stages of an attack.

Our Approach

As part of a threat detection enhancement project, we implemented a SIEM use case designed to identify attempts to enumerate installed security products using Windows Management Instrumentation (WMI) and PowerShell.

The detection monitored:

• WMI queries against SecurityCenter2 namespaces
• Enumeration of antivirus and firewall products
• PowerShell and WMIC commands associated with security software discovery
• Endpoint process execution telemetry

Alerts were generated whenever users or systems executed commands commonly associated with security control reconnaissance.

Outcome

The implementation provided early visibility into adversary behavior that often precedes malware deployment, privilege escalation, or lateral movement.

Key benefits included:

• Earlier detection of potential compromise
• Improved visibility into attacker reconnaissance activity
• Faster incident response and threat hunting capabilities
• Enhanced protection of payment processing infrastructure
• Reduced risk of successful defense-evasion attempts

The use case became a valuable component of the client's proactive threat detection and monitoring strategy.