Potential AV Reconnaissance Via Powershell

X__Junior, Swachchhanda Shrawan Poudel

Detects Powershell commands that query the SecurityCenter2 namespace using Get-WmiObject or Get-CimInstance, potentially for AV/AntiSpyware reconnaissance. Threat actors often use these powershell commands to enumerate installed security products on a system to identify security solutions present on the system, plan evasion tactics based on discovered security products, and determine potential weaknesses in the security posture. This technique is commonly used in the initial reconnaissance phase of an attack.

2025-02-27 00:00:00

2025-03-17 00:00:00

9e56c53b-9332-44a2-b3dc-13e25c0f6690

attack.defense-evasion attack.discovery attack.t1082

Nextron Sigma feed only (private)