It is important to enumerate antivirus and security detection methods on an endpoint in order to stay as undetected as possible and reduce the chance of getting caught. We will see various techniques to enumerate the target's security solutions.
Practice
We can enumerate AV software using Windows built-in tools, such as wmic
We need Admin privileges in order to modify NetFirewall properties
Sysmon (System Monitor) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log.
To detect sysmon on a target we can do:
# With process list
Get-Process | Where-Object { $_.ProcessName -eq "Sysmon" }
# With services list
Get-CimInstance win32_service -Filter "Description = 'System Monitor service'"
Get-Service | where-object {$_.DisplayName -like "*sysm*"}
#Windows Registry
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational
If the target system is running Sysmon, we must try to locate its configuration file
