Security Product Discovery via Get-MpComputerStatus, WMIC, sc query, or reg query

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects reconnaissance activities where an adversary attempts to identify installed security software (AV, EDR, logging tools) on a Windows host. The rule identifies the execution of common discovery commands including PowerShell Get-MpComputerStatus, wmic, sc query, tasklist, and reg query targeting specific security process names and registry paths.