WMI Query for Installed AntiVirus Products via Scripting Interpreters
Detects WMI queries for installed AntiVirus products executed via scripting interpreters such as wscript.exe, cscript.exe, powershell.exe, or wmic.exe. This behavior may indicate an attempt to gather information about security software on the system, which can be a precursor to evasion or targeted attacks.
Sigma
