Reconnaissance of AV Products via PowerShell or WMI

This rule detects suspicious PowerShell script execution that attempts to identify installed anti-virus products using WMI or PowerShell commands. It specifically looks for PowerShell Script Block Logging (EventCode 4104) entries containing keywords like "SELECT," "WMIC," "AntiVirusProduct," or "AntiSpywareProduct." This activity is often performed by malware and APT actors to map security applications for evasion purposes, potentially leading to the disabling or bypassing of security measures.