(SIGMA) CAPA_fingerprint_av

Created the . Updated 1 year, 10 months ago.

            title: Get antivirus details via WMIC query
status: experimental
description: Get antivirus details via WMIC query
author: Joe Security
date: 2020-03-27
id: 200069
threatname:
behaviorgroup: 5
classification: 8
mitreattack:

logsource:
      category: process_creation
      product: windows
detection:
      selection:
          CommandLine:
              -'*wmic * path antivirusproduct get displayname*'
      condition: selection
level: critical

Download Raw

Associated Techniques

Technique Name	Technique ID's	Has Snippet(s)
Fingerprinting Emulator	U0513