Amadey/StealC WMI AntiVirusProduct Query and tasklist.exe Enumeration

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects the Amadey loader or StealC information stealer performing situational awareness by enumerating security software via WMI queries for 'AntiVirusProduct'. This behavior is typical of malware attempting to identify and evade defensive tools.