Remcos Process Enumeration via tasklist and WMIC SecurityCenter2 Query

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects suspicious discovery commands often used by adversaries for environmental reconnaissance, including querying security product status via WMIC, enumerating installed software, or executing tasklist.exe from non-standard system paths.