Argamal RAT Security Software Enumeration via tasklist and WMI
Detects reconnaissance activity by Argamal RAT where it enumerates installed security products (AV/EDR) using tasklist.exe or WMI queries (PowerShell or wmic.exe). The rule monitors for processes that target specific security software strings within suspicious process execution contexts.
Microsoft Sentinel (KQL)
