PowerShell Query for Antivirus Product Information

Tim Peck@timpeck

•updated Mar 30, 2026•7•0•100

Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. This technique is often used by malware, such as EtherRAT's SYS_INFO module, to map defensive tooling and understand the security posture of a compromised system.