Security Software Discovery via PowerShell SecurityCenter2 AntiVirusProduct Query

Duo Tech@duotech

•updated Jul 21, 2026•1•0•1

Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.