https://techygeekshome.info/2014/01/sccm-2012-wql-query-for-machines/
SCCM - WQL Query for machines without Endpoint Protection installed