PowerShell Enumeration of Security Products via WMI/CIM - Powershell

Swachchhanda Shrawan Poudel

Detects Powershell commands that query the SecurityCenter2 namespace using Get-WmiObject or Get-CimInstance, potentially for AV/AntiSpyware reconnaissance. Threat actors often use these powershell commands to enumerate installed security products on a system to identify security solutions present on the system, plan evasion tactics based on discovered security products, and determine potential weaknesses in the security posture. This technique is commonly used in the initial reconnaissance phase of an attack.

2025-03-17 00:00:00

None

eadc4a02-c213-4f8a-952c-ec836cc31d6b

attack.defense-evasion attack.discovery attack.t1082

Nextron Sigma feed only (private)