Antivirus Discovery via WMI/CIM

Bryant Smith@flowstate

•updated Mar 30, 2026•1•0•80

Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. The EtherRAT SYS_INFO module aggressively maps defensive tooling to tailor follow-on payloads and evade detection.