LokiBot/StealC Security Product Enumeration via WMI SecurityCenter2 from Suspicious Parent

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects information stealer malware, such as LokiBot or StealC, attempting to enumerate installed security software, firewall configurations, and system services. The rule monitors for WMI queries to 'SecurityCenter2' or registry enumeration of uninstallation/service keys originating from processes executing within user-writable, high-risk directories such as Temp, Downloads, or ProgramData, while filtering out known legitimate system processes.