AV and EDR Product List Queried via Web Shell

Darshan Thummar@Mighty

•updated Jun 12, 2026•1•0•4

This rule detects attempts to query the list of installed AntiVirus (AV) and Endpoint Detection and Response (EDR) products via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'AntiVirus' in the URI, indicating an attempt to use Windows Management Instrumentation Command-line (WMIC) to enumerate security software.