SocGholish - WMI Anti-Virus Enumeration via JS (T1518.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•3•0•7

Identifies JScript payloads leveraging wmiprvse.exe to query SecurityCenter2 and enumerate installed endpoint protection products, often associated with SocGholish activity.