VBScript Host Reconnaissance via Win32_Process Enumeration and AntiVirusProduct WMI Query

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•0

Detects VBScript-driven reconnaissance using wscript.exe that executes WMI queries to enumerate running processes via Win32_Process or identifies installed antivirus products via the SecurityCenter2 namespace. This behavior is often associated with early-stage malware reconnaissance activities.