WMI AV Reconnaissance via SecurityCenter2

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects WMI activity where 'wmiprvse.exe' is used to query 'SecurityCenter2' for antivirus product information. This behavior is often associated with adversaries performing reconnaissance to identify security software.