PowerShell Hotfix Enumeration

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects PowerShell scripts that enumerate installed hotfixes by querying 'Win32_QuickFixEngineering' and looking for 'HotFixID'. This activity is often performed by attackers during the discovery phase to gather system information.