Security Software Discovery via WMIC SecurityCenter2 and WMI Win32_Product Enumeration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•3

Detects reconnaissance activity where an adversary uses common administrative utilities (e.g., wmic, powershell, tasklist, sc, reg) to identify installed security software, antivirus products, or monitoring agents on a Windows system. This activity is often a precursor to defense evasion or impairment.