Skip to content
HackIndex.io

Windows Antivirus and EDR Enumeration

4 min read Created Apr 4, 2026 Last updated Jul 14, 2026

Knowing what security tooling is active on a target shapes every subsequent decision. This enumeration runs early, before anything that might trigger an alert. Key areas to check:

  • Installed antivirus and EDR products (process names, services)

  • Windows Defender real-time protection and exclusion paths

  • AMSI status and bypass potential

  • AppLocker or WDAC application control policies

  • Credential Guard and LSA protection configuration

The results determine which tools to use, how to transfer files, and which evasion techniques are worth attempting.

Installed security products

PS C:\Users\Guest\Desktop> # WMI security center query (works on workstations, not servers)
PS C:\Users\Guest\Desktop> Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Select-Object displayName, productState, pathToSignedProductExe
PS C:\Users\Guest\Desktop> Get-WmiObject -Namespace root\SecurityCenter2 -Class FirewallProduct | Select-Object displayName, productState
PS C:\Users\Guest\Desktop> Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | Select-Object displayName, productState
 
PS C:\Users\Guest\Desktop> # Running processes: security tools
PS C:\Users\Guest\Desktop> Get-Process | Where-Object {$_.Name -match 'defender|crowdstrike|sentinel|cylance|carbon|cbdefense|tanium|symantec|mcafee|sophos|kaspersky|eset|bitdefender|malwarebytes|cylance|cybereason'} | Select-Object Name, Id, Path
 
PS C:\Users\Guest\Desktop> # Installed security software via registry
PS C:\Users\Guest\Desktop> Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {$_.DisplayName -match 'defender|crowdstrike|sentinel|cylance|carbon|tanium|symantec|mcafee|sophos'} | Select-Object DisplayName, DisplayVersion

Windows Defender status

Windows Defender is present on every modern Windows installation. Check its status and configured exclusions: exclusion paths are locations where you can drop and run tools without triggering detections.

PS C:\Users\Guest\Desktop> # Defender status
PS C:\Users\Guest\Desktop> Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled, AntivirusEnabled, RealTimeProtectionEnabled, IoavProtectionEnabled, BehaviorMonitorEnabled
 
PS C:\Users\Guest\Desktop> # Exclusion paths (can drop tools here without detection)
PS C:\Users\Guest\Desktop> Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess
 
PS C:\Users\Guest\Desktop> # Defender version and signature date
PS C:\Users\Guest\Desktop> Get-MpComputerStatus | Select-Object AMProductVersion, AntivirusSignatureLastUpdated, AntivirusSignatureVersion
 
PS C:\Users\Guest\Desktop> # Check if Defender is the active AV or just monitoring
PS C:\Users\Guest\Desktop> Get-MpComputerStatus | Select-Object AMRunningMode 
AMServiceEnabled          : True
RealTimeProtectionEnabled : True
ExclusionPath             : {C:\Windows\Temp, C:\Tools}

Exclusion paths in Defender are gold: any file dropped in those directories will not be scanned. Check ExclusionPath output carefully and use those locations for tool staging.

AMSI status

AMSI (Antimalware Scan Interface) intercepts PowerShell, JScript, VBScript, and other script content before execution. It cannot be queried directly but its presence can be inferred.

PS C:\Users\Guest\Desktop> # Check if AMSI is loaded in current PowerShell session
PS C:\Users\Guest\Desktop> [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
 
PS C:\Users\Guest\Desktop> # Check script block logging (records all PowerShell executed)
PS C:\Users\Guest\Desktop> Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # Check module logging
PS C:\Users\Guest\Desktop> Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # Check transcription logging
PS C:\Users\Guest\Desktop> Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription -ErrorAction SilentlyContinue

AppLocker and application control

AppLocker restricts which executables and scripts can run. Understanding the policy tells you which paths and file types are allowed, which shapes where you can execute tools from.

PS C:\Users\Guest\Desktop> # Check if AppLocker is configured
PS C:\Users\Guest\Desktop> Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections
 
PS C:\Users\Guest\Desktop> # XML output: full policy detail
PS C:\Users\Guest\Desktop> Get-AppLockerPolicy -Effective -Xml
 
PS C:\Users\Guest\Desktop> # Check via registry
PS C:\Users\Guest\Desktop> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2
 
PS C:\Users\Guest\Desktop> # Test if a specific path is allowed
PS C:\Users\Guest\Desktop> Get-AppLockerPolicy -Effective | Test-AppLockerPolicy -Path C:\Windows\Temp\tool.exe -User Everyone

AppLocker commonly allows execution from C:\Windows\ and C:\Program Files\. Writable subdirectories within those paths (such as C:\Windows\Tasks\ or C:\Windows\Temp\) are common bypass locations. If AppLocker is in audit mode rather than enforce mode, nothing is actually blocked.

Credential Guard and LSA protection

These settings affect whether LSASS can be dumped directly. Check them before attempting credential extraction.

PS C:\Users\Guest\Desktop> # LSA protection (RunAsPPL: prevents LSASS dumping)
PS C:\Users\Guest\Desktop> reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL
 
PS C:\Users\Guest\Desktop> # Credential Guard
PS C:\Users\Guest\Desktop> reg query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity
PS C:\Users\Guest\Desktop> reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags
 
PS C:\Users\Guest\Desktop> # WDigest: if enabled, plaintext creds in LSASS (legacy)
PS C:\Users\Guest\Desktop> reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential 
RunAsPPL    REG_DWORD    0x1

UseLogonCredential    REG_DWORD    0x0

RunAsPPL = 1 means LSASS runs as a protected process: standard dump methods will fail. You need a kernel-level driver or a signed tool like ProcDump with the right permissions. UseLogonCredential = 1 means WDigest is enabled and plaintext credentials are stored in LSASS: a significant misconfiguration on modern systems.