
(SIGMA) CAPA_fingerprint_av
Created the . Updated 1 year, 3 months ago.
title: Get antivirus details via WMIC query
status: experimental
description: Get antivirus details via WMIC query
author: Joe Security
date: 2020-03-27
id: 200069
threatname:
behaviorgroup: 5
classification: 8
mitreattack:
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine:
-'*wmic * path antivirusproduct get displayname*'
condition: selection
level: critical
Associated Techniques
Technique Name | Technique ID's | Has Snippet(s) |
---|---|---|
Fingerprinting Emulator | U0513 |