Grandoreiro WMI SecurityCenter2 AV enumeration from browser/Office parent

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects suspicious WMI queries to the SecurityCenter2 namespace for security product information (AntiVirusProduct, AntiSpywareProduct, FirewallProduct) originating from common web browsers or document editors. This behavior is indicative of the Grandoreiro banking trojan attempting to identify and evade security software.