PowerShell Hotfix Enumeration

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by attackers