[New WTFBin]: Jetbrains IDE using WMI to query antivirus product

[ThureinOo]

• Contributor Name: Thurein Oo
• Application/Executable: idea64.exe, rider64.exe (Jetbrains)
• WTF Behavior Description: idea64.exe and rider64.exe from Jetbrains query the installed antivirus product in the exact same way that malicious programs do using the command: wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname,productstate
• Link to Documentation of Behavior: https://rider-support.jetbrains.com/hc/en-us/community/posts/360010724079-Why-is-Rider-making-wmic-commands-to-get-AntiVirus-name- https://security.stackexchange.com/questions/255534/jetbrains-ide-using-wmi-to-query-antivirus-product
• Please provide any images for additional evidence.

[mttaggart]

This one is amazing. Thank you! I wonder what they'll do after wmic goes away...

[mttaggart]

Added in c064cff8