Storm-2561 - WMI Antivirus Reconnaissance (T1518.001)
Identifies the fake VPN installer using WMI to query SecurityCenter2 to identify installed security products before unpacking the stealer. This rule specifically looks for 'wmiprvse.exe' executing with command-line arguments related to 'AntiVirusProduct' and correlates this with the execution of processes named 'GlobalProtect', 'AnyConnect', or 'VPN'.
Microsoft Sentinel (KQL)
