Possible Windows Hotfix Updates Recon Through Wmic.EXE (via process_creation)

title: Possible Windows Hotfix Updates Recon Through Wmic.EXE (via process_creation)
id: 7b6c2e92-886b-55a3-ab5f-ea0d5332f2a3
status: stable
description: This rule detects the execution of wmic with the "qfe" flag to obtain information about installed hotfix updates on the system. This is frequently used by pentester and adversary enumeration scripts
references:
    - https://attack.mitre.org/techniques/T1047/
    - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
    - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
author: Huntrule Team
date: 2026-05-31
tags:
    - attack.execution
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - OriginalFileName: 'wmic.exe'
        - Image|endswith: '\WMIC.exe'
    selection_cli:
        CommandLine|contains: ' qfe'
    condition: all of selection*
falsepositives:
    - Unknown
level: medium
simulation:
    - type: atomic-red-team
      name: WMI Reconnaissance Software
      technique: T1047
      atomic_guid: 718aebaa-d0e0-471a-8241-c5afa69c7414
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix/info.yml