Security Software Enumeration Before Defence Impairment (T1518/T1082)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the execution of common Windows system utilities (tasklist.exe, sc.exe, reg.exe, wmic.exe, powershell.exe) with command-line arguments indicative of security software, antivirus product, or system service enumeration. This activity is frequently associated with reconnaissance efforts by threat actors attempting to identify defensive capabilities.