# Windows Antivirus and EDR Enumeration

> Techniques for identifying installed AV and EDR solutions on Windows systems, including registry queries, process enumeration, and WMI-based detection methods.

- **URL:** https://hackindex.io/platforms/windows/enumeration/windows-antivirus-and-edr-enumeration
- **Path:** Windows > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/windows/enumeration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

Knowing what security tooling is active on a target shapes every subsequent decision. This enumeration runs early, before anything that might trigger an alert. Key areas to check:

- Installed antivirus and EDR products (process names, services)
- Windows Defender real-time protection and exclusion paths
- AMSI status and bypass potential
- AppLocker or WDAC application control policies
- Credential Guard and LSA protection configuration

The results determine which tools to use, how to transfer files, and which evasion techniques are worth attempting.

## Installed security products

**Security product enumeration**

```powershell
# WMI security center query (works on workstations, not servers)
Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Select-Object displayName, productState, pathToSignedProductExe
Get-WmiObject -Namespace root\SecurityCenter2 -Class FirewallProduct | Select-Object displayName, productState
Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | Select-Object displayName, productState

# Running processes: security tools
Get-Process | Where-Object {$_.Name -match 'defender|crowdstrike|sentinel|cylance|carbon|cbdefense|tanium|symantec|mcafee|sophos|kaspersky|eset|bitdefender|malwarebytes|cylance|cybereason'} | Select-Object Name, Id, Path

# Installed security software via registry
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {$_.DisplayName -match 'defender|crowdstrike|sentinel|cylance|carbon|tanium|symantec|mcafee|sophos'} | Select-Object DisplayName, DisplayVersion
```

## Windows Defender status

Windows Defender is present on every modern Windows installation. Check its status and configured exclusions: exclusion paths are locations where you can drop and run tools without triggering detections.

**Windows Defender configuration**

```powershell
# Defender status
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled, AntivirusEnabled, RealTimeProtectionEnabled, IoavProtectionEnabled, BehaviorMonitorEnabled

# Exclusion paths (can drop tools here without detection)
Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

# Defender version and signature date
Get-MpComputerStatus | Select-Object AMProductVersion, AntivirusSignatureLastUpdated, AntivirusSignatureVersion

# Check if Defender is the active AV or just monitoring
Get-MpComputerStatus | Select-Object AMRunningMode
# AMServiceEnabled          : True
# RealTimeProtectionEnabled : True
# ExclusionPath             : {C:\Windows\Temp, C:\Tools}
```

Exclusion paths in Defender are gold: any file dropped in those directories will not be scanned. Check `ExclusionPath` output carefully and use those locations for tool staging.

## AMSI status

AMSI (Antimalware Scan Interface) intercepts PowerShell, JScript, VBScript, and other script content before execution. It cannot be queried directly but its presence can be inferred.

**AMSI and script block logging**

```powershell
# Check if AMSI is loaded in current PowerShell session
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')

# Check script block logging (records all PowerShell executed)
Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging -ErrorAction SilentlyContinue

# Check module logging
Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging -ErrorAction SilentlyContinue

# Check transcription logging
Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription -ErrorAction SilentlyContinue
```

## AppLocker and application control

AppLocker restricts which executables and scripts can run. Understanding the policy tells you which paths and file types are allowed, which shapes where you can execute tools from.

**AppLocker policy enumeration**

```powershell
# Check if AppLocker is configured
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

# XML output: full policy detail
Get-AppLockerPolicy -Effective -Xml

# Check via registry
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2

# Test if a specific path is allowed
Get-AppLockerPolicy -Effective | Test-AppLockerPolicy -Path C:\Windows\Temp\tool.exe -User Everyone
```

AppLocker commonly allows execution from `C:\Windows\` and `C:\Program Files\`. Writable subdirectories within those paths (such as `C:\Windows\Tasks\` or `C:\Windows\Temp\`) are common bypass locations. If AppLocker is in audit mode rather than enforce mode, nothing is actually blocked.

## Credential Guard and LSA protection

These settings affect whether LSASS can be dumped directly. Check them before attempting credential extraction.

**LSA and Credential Guard status**

```powershell
# LSA protection (RunAsPPL: prevents LSASS dumping)
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL

# Credential Guard
reg query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags

# WDigest: if enabled, plaintext creds in LSASS (legacy)
reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential
# RunAsPPL    REG_DWORD    0x1
#
# UseLogonCredential    REG_DWORD    0x0
```

`RunAsPPL = 1` means LSASS runs as a protected process: standard dump methods will fail. You need a kernel-level driver or a signed tool like ProcDump with the right permissions. `UseLogonCredential = 1` means WDigest is enabled and plaintext credentials are stored in LSASS: a significant misconfiguration on modern systems.