Windows Hotfix Updates Reconnaissance Via Wmic.EXE

Title: Windows Hotfix Updates Reconnaissance Via Wmic.EXE
Status: test
Description:Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts
References:
  -https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
  -https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
modified:2023-02-14
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
OriginalFileName:'wmic.exe' Image|endswith:'\WMIC.exe'   selection_cli:
    CommandLine|contains: ' qfe'
  condition:all of selection*
Falsepositives:
  -Unknown
Level: medium