WMI Query Enumerating AV Products via Win32_AntivirusProduct

Subhankar H@Andrewsec57

•updated Jul 6, 2026•1•0•4

Detects the use of WMI queries targeting the Win32_AntivirusProduct class or the root\SecurityCenter2 namespace to enumerate installed antivirus products on a Windows host. This technique is commonly used by adversaries for discovery during the reconnaissance phase to identify security controls before proceeding with further malicious actions.