AV/EDRs are kinda lame but "brute force all known vulnerabilities" is definitely something they can detect.