Windows Hotfix Updates Reconnaissance Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of 'wmic.exe' with the 'qfe' flag to enumerate installed hotfix updates on a Windows system. This activity is commonly observed in penetration testing and attacker reconnaissance scripts to gather system information.