T1518.001 Security Software Discovery in real malware
ATT&CK technique T1518.001 Security Software Discovery appears in 155 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.2% of the analyzed corpus. Seven-day prevalence is rising (155 recent vs 0 prior). Most associated families: HUILoader, Delf, Vindor, RedLine, AgentTesla.
Tactics: discovery
Prevalence in the corpus
- Samples exhibiting T1518.001: 155
- Share of analyzed corpus: 0.2%
- Last 7 days: 155 · prior 7 days: 0 (rising)
Malware families using T1518.001
- HUILoader - 32 samples
- Delf - 16 samples
- Vindor - 15 samples
- RedLine - 11 samples
- AgentTesla - 5 samples
- Remcos - 4 samples
Example samples
- 6c0e5e6620a3557e0d94570545123a91b6ae234142a1182e5fa75dbaada7650a - malicious
- b1553dba597d062aecbae96d079f9ad873861f46f35da41da425095dfedbd455 - malicious
- 4eaf8dbd0b9d67dcfc003192b8d975c891182e95681c7f2122a47cb0422fe982 - malicious
- cdd298849c4406b391d5604c6d17cccef45d98354cfee956193c818c9ac3b63e - malicious
- f428d4b689ac95dcd2872c008340cbb3487acfe4f010e072279fb8a7e82cb9ea - malicious
- ee6ed06897896ab87a9a84035fd7e7f2ff889afc7794017428fe1805dc09b8ea - malicious
- 91b96b9b90bf46dcb9d6dbebf5fabc40a991d0ffb26858436d5b04df21797231 - malicious
- 8d993cc504fc39db3eeda4ef24903b5e30aa081d8a751c010d8c759f1db0943b - malicious
- 8111f53495650a9a9324ab3800755ea856c304604fb652a7a002656c61b4e601 - malicious
- dabb01de1317476c0bce26ba27173316d80db8460a7b036240e406402f162484 - malicious
- 457f722647635ef1077bc264427e446b50f5c9752f7179ca63b7e3123d7afc7e - malicious
- 959072d8aadd4f2b80a770af048809303b469e973f01405b231cb39c76656369 - malicious
- 12013878e0c9d358aabe48106fef285f0ed5ea784f5da5dfa6c627cc03e572bc - malicious
- 8ca2533fcd9f0fff46a600ea117cf0b8bf20075f4cbd33c47abf463deae82ba2 - malicious
- a76c1abd038973ddec464bc5c94af0bd6b7a9568c09193216eaad2c21e8d9c5a - malicious
- e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87 - malicious
- ffc48dea7fbd3a9fdb4cd6b5f4b3436f04c30fc7603d8bdfd7f27fe4c554ea75 - malicious
- 5f1881a98712a536b3b9348ec351567cd2f01b7d8f7d55c4e9cf166a37e8b15a - malicious
- 8a94201178f7a044a49f22973e8920a139ec67e83bcc42624541a0f1da013289 - malicious
- e9a944edfe7f2fcef1baa1648117cdbf060fe9383cfa54823ea4320e68186a95 - malicious
- b6c6f71b45f3e445bff9f109e6a23fb9598ed91e2b54209266093526b62ea6f3 - malicious
- 42e73963eb434e600a9631f2e161562b6de2178e522b07b26adf3ee6cd38c26d - malicious
- 191ec88a8ef8636c3623ce75f2a65760b0a66c4d69e28e4108026d3ce26ba812 - malicious
- fc87df3e54fd0c9591f8b768d3bc9527128a4b4ddb9533db87c13a38e50e1dc9 - malicious
- f85fb511f4c7535d8776199ab689aa8ac7881e2fc1c698c6fd4b8a09152dfc50 - malicious
Canonical technique definition: MITRE ATT&CK T1518.001 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1518.001
- How common is ATT&CK T1518.001 (Security Software Discovery) in real malware?
- ATT&CK technique T1518.001 Security Software Discovery appears in 155 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.2% of the analyzed corpus. Seven-day prevalence is rising (155 recent vs 0 prior). Most associated families: HUILoader, Delf, Vindor, RedLine, AgentTesla.
- Is T1518.001 becoming more common?
- Prevalence is rising: 155 samples in the last seven days against 0 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1518.001?
- In this corpus T1518.001 is most associated with HUILoader (32), Delf (16), Vindor (15), RedLine (11), AgentTesla (5), Remcos (4). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1518.001?
- 0.2% of the publicly analyzed corpus (155 of 100981 samples) exhibits T1518.001. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats