GigaWiper GRATClientInfo Host Reconnaissance via PowerShell AntiVirusProduct Query

Duo Tech@duotech

•updated Jul 21, 2026•0•0•2

Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.