diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
index 260ccc4f77..1d8b4a3242 100644
--- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
+++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
@@ -11,7 +11,7 @@ description: The following analytic identifies suspicious PowerShell script exec
   adversary will map all running security applications or services. During triage,
   review parallel processes within the same timeframe. Review the full script block
   to identify other related artifacts.
-search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*"
+search: '`powershell` EventCode=4104 (Message = "*SELECT*" OR Message = "*WMIC*") AND (Message = "*AntiVirusProduct*"
   OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time)
   as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`'