Grandoreiro WMI AV Enumeration via wmic.exe or wscript VBS WMI Query

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•4

Detects the execution of wmic.exe with commands querying Windows Management Instrumentation (WMI) classes (AntiVirusProduct, SecurityCenter2, Win32_Product) often used by the Grandoreiro banking trojan to identify installed security software and sandbox environments. The rule specifically monitors for suspicious parent-child relationships, such as wscript.exe, cscript.exe, or mshta.exe spawning wmic.exe, especially when the originating script or binary is unsigned or originating from non-standard paths like AppData.