Skip to main content

​
Overview

The McAfeeConfigs command searches for McAfee antivirus configuration files on the system. These configuration files may contain valuable information about security settings, exclusions, and deployment configurations.

​
Syntax

Seatbelt.exe McAfeeConfigs
This command does not support remote execution.

​
Output

Returns information about McAfee configuration files:
  • File paths
  • Configuration file locations
  • SiteList.xml locations (if present)

​
Use Cases

  • Red Team
  • Blue Team
  • Identify McAfee exclusion paths
  • Discover security product configuration
  • Find potential evasion opportunities
  • Locate encrypted credentials in SiteList.xml

​
Example Output

====== McAfeeConfigs ======

Found McAfee configuration files:

C:\ProgramData\McAfee\Agent\Config\config.xml
C:\ProgramData\McAfee\Common Framework\SiteList.xml
C:\ProgramData\McAfee\DesktopProtection\policies.xml

​
Remote Execution

This command does NOT support remote execution.

​
Detection Considerations

Low detection risk - file system enumeration.