Payouts King Security Tool Process Enumeration via tasklist, wmic, or PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects the use of common Windows utilities and PowerShell commands for process discovery, such as tasklist.exe, wmic.exe, and Get-Process. It also flags execution of command lines containing references to known antivirus, EDR, or security agent process names, which is a common indicator of an adversary attempting to identify or disable security tools.