WLDR Agent PowerShell WMI Reconnaissance for AV Product, Network Adapter Config, and UAC Policy

Duo Tech@duotech

•updated Jul 16, 2026•1•0•2

Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.