AV Enumeration via WMIC
Detects WMI queries targeting the SecurityCenter2 namespace to enumerate installed antivirus products. Attackers, such as Seedworm, use this command shortly after initial access to map out defensive tooling before deploying evasive loaders.
Sigma
