Detection: Recon AVProduct Through Pwh or WMI

Updated Date: 2026-05-13 ID: 28077620-c9f6-11eb-8785-acde48001122 Author: Teoderick Contreras, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects suspicious PowerShell script execution via EventCode 4104, specifically targeting checks for installed anti-virus products using WMI or PowerShell commands. This detection leverages PowerShell Script Block Logging to identify scripts containing keywords like "SELECT," "WMIC," "AntiVirusProduct," or "AntiSpywareProduct." This activity is significant as it is commonly used by malware and APT actors to map running security applications or services, potentially aiding in evasion techniques. If confirmed malicious, this could allow attackers to disable or bypass security measures, leading to further compromise of the endpoint.

Search

 1`powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText = "*WMIC*") AND (ScriptBlockText = "*AntiVirusProduct*" OR ScriptBlockText = "*AntiSpywareProduct*")
 2  
 3| fillnull
 4  
 5| stats count min(_time) as firstTime max(_time) as lastTime
 6    BY dest signature signature_id
 7       user_id vendor_product EventID
 8       Guid Opcode Name
 9       Path ProcessID ScriptBlockId
10       ScriptBlockText
11  
12| `security_content_ctime(firstTime)`
13  
14| `security_content_ctime(lastTime)`
15  
16| `recon_avproduct_through_pwh_or_wmi_filter`

Data Source

Name	Platform	Sourcetype	Source
Powershell Script Block Logging 4104	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
recon_avproduct_through_pwh_or_wmi_filter	`search *`

recon_avproduct_through_pwh_or_wmi_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1592	Gather Victim Host Information	Reconnaissance

reconnaissance

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	Yes

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.

Known False Positives

network administrator may used this command for checking purposes

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
A suspicious powershell script contains AV recon command on host $dest$	user_id	user	50

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
A suspicious powershell script contains AV recon command on host $dest$	dest	system	50

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 15