Detection rule for SEP IPS?

Hi,

I need a detection rule for Symantec Endpoint Protection 12.1 with Intrusion Prevention System (IPS) installed. How to detect if IPS is installed or not? I need something more than the usual MSI Product Code - a file or a registry valye to check?