Security Software Discovery Targeting Sysmon Filebeat and Defender

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the enumeration of installed security and monitoring software, such as Sysmon, Filebeat, and Microsoft Defender, using common system administration tools including sc.exe, tasklist.exe, wmic.exe, PowerShell, and reg.exe. This activity is often associated with reconnaissance performed prior to disabling security features on a compromised host.