SilentCanvas - WMI SecurityCenter Reconnaissance

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•4

This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.