examples:

• description: "Execute JetBrains binaries invoke WMI and observe the unusual behavior" command: "JetBrains binaries invoke WMI"

JetBrains binaries invoke WMI

JetBrains queries security tools.

idea64.exe and rider64.exe from JetBrains query the installed antivirus product in the exact same way that malicious programs do using the command:

wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname,productstate

Contributed by Thurein Oo