Anti-Virus Product Reconnaissance via PowerShell or WMI

This threat brief focuses on the detection of a specific reconnaissance technique where adversaries or malware utilize PowerShell or Windows Management Instrumentation (WMI) to identify installed anti-virus (AV) and anti-spyware products on an endpoint. This activity is typically logged via PowerShell Script Block Logging (EventCode 4104) and is characterized by the execution of scripts containing keywords such as "SELECT," "WMIC," "AntiVirusProduct," or "AntiSpywareProduct." The technique is commonly employed by advanced persistent threat (APT) groups and various malware families (e.g., Maze ransomware, XWorm, Qakbot) to gain an understanding of the security posture of a compromised system. By mapping the running security applications, attackers can strategize evasion techniques, develop methods to disable or bypass security controls, and ultimately facilitate further malicious activities, leading to deeper compromise and data exfiltration or encryption.

Attack Chain

1. Initial Access (Pre-requisite): An attacker gains initial access to a target system through various means (e.g., spearphishing, exploiting a vulnerability).
2. Execution: The attacker executes a PowerShell script on the compromised endpoint.
3. Reconnaissance Command: The PowerShell script or command utilizes WMI queries or native PowerShell cmdlets to enumerate installed security products.
4. Query Execution: The script issues commands such as SELECT * FROM AntiVirusProduct or WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName.
5. Information Gathering: The executed query returns details about the anti-virus and anti-spyware solutions present on the system.
6. Defense Evasion Planning: The attacker collects this information to understand the security landscape of the host, which is then used to plan subsequent actions aimed at evading or disabling detected security software.
7. Follow-on Malicious Activity: Based on the reconnaissance, the attacker proceeds with further stages of the attack, such as payload delivery, persistence mechanisms, or exfiltration, tailored to bypass the identified defenses.

Impact

The successful execution of anti-virus product reconnaissance provides attackers with critical intelligence about a target's defensive capabilities. This information directly enables threat actors to refine their defense evasion strategies, bypass security controls, and prevent detection. If attackers can effectively circumvent security software, the impact includes increased risk of data exfiltration, deployment of ransomware, establishment of persistent access, and broader network compromise. While no specific victim counts or sectors are mentioned for this isolated technique, it is a foundational step in many targeted attacks, facilitating severe outcomes across any targeted organization.

Recommendation

• Enable PowerShell Script Block Logging (EventCode 4104): Ensure PowerShell Script Block Logging is comprehensively enabled across all Windows endpoints to capture script content that this detection relies on.
• Deploy the Sigma rules in this brief to your SIEM: Implement the provided Sigma rule to detect suspicious PowerShell commands targeting AV/AS product reconnaissance using ScriptBlockText fields.
• Tune for environment-specific false positives: Review the falsepositives section of the Sigma rule and create exceptions for known legitimate administrative or security tooling in your environment that might perform similar checks.