diff --git a/installed_av.ps1 b/installed_av.ps1
new file mode 100644
index 0000000..2e53d2d
--- /dev/null
+++ b/installed_av.ps1
@@ -0,0 +1 @@
+Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct | Select-Object -Property displayName, pathToSignedProductExe | ConvertTo-Json -Compress
\ No newline at end of file