Windows Hotfix Updates Reconnaissance Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Jun 24, 2026•1•0•1

Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts