1

Why would different JetBrains IDE products need to query the installed antivirus product in the exact same way that malicious programs do?

The wmi command is the following:

wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname,productstate

I observed this command coming from idea64 (intellij) and pycharm, both of which are IDE programs designed by jetbrains. I cant understand why an IDE would need to perform this activity.

This wmi query if googled comes up as a common malicious behavior to detect the security products on the device, and whether or not they are running. Anyone got any insight into this?

Improve this question
2
  • I recall observing the same behaviour for many customers as SOC analyst. Looks like the file itself is okay and not malicious, but I totally second your question "why my IDE does that". My usual answer is "because software developers are not only insane but also incompetent". Even stranger operations are performed by different software sometimes, you can't predict what those weirdos might do next time 😁
    – Alex
    Sep 25 at 12:18
  • Yeah I created an alert for any previously unknown WMI command lines in a SIEM and this keeps popping up whenever somebody runs an IDE. At least its not malicious activity
    – dcom-launch
    Sep 29 at 18:19
2

Here is an answer of sorts but mainly because this was too much for a comment. I don't have it installed but having downloaded the file ideaIU-2021.2.2.exe and unzipped it, then running:

for /r %i in (*.dll) do strings64 %i | FIND "SecurityCenter"

It picked out this DLL as containing the string: "\ideaIU-2021.2.2\jbr\bin\libcef.dll Properties of libcef.dll

Closer inspection with strings on this one file shows strings such as:

UMA.AntiVirusMetricsProvider.Result
../../chrome/services/util_win/av_products.cc
FillAntiVirusProductsFromWSC
zFillAntiVirusProductsFromWMI
OOT\SecurityCenter2
WQL
SELECT * FROM AntiVirusProduct
productState
displayName
pathToSignedProductExe
MaybeAddUnregisteredAntiVirusProducts
Trusteer
Rapport
RapportService.exe
Trusteer Endpoint Protection
drivers
parity.sys
CB Protection
365
360
NOD32
GetAntiVirusProducts
metrics.SystemProfileProto.AntiVirusProduct
Misconfigured Antivirus

So I can imagine this module does have a routine called GetAntiVirusProducts that uses WMI and WSC to obtain a list of registered anti-virus products.

See the code here:

https://source.chromium.org/chromium/chromium/src/+/main:chrome/services/util_win/av_products.cc;l=453?q=GetAntiVirusProducts&ss=chromium

Is this the module you see the request coming from? Is this the only one?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.