PowerShell Hotfix Enumeration via Win32_QuickFixEngineering

Detects PowerShell scripts enumerating installed hotfixes by querying Win32_QuickFixEngineering for HotFixID.

FreeUnreviewedSigmamediumv1

powershell-hotfix-enumeration-via-win32-quickfixengineering-f5d1def8

title: PowerShell Hotfix Enumeration via Win32_QuickFixEngineering
id: daffc04d-236c-4ff8-8266-64bbfd66f101
status: test
description: This rule flags PowerShell script block text that references the Win32_QuickFixEngineering WMI class along with the HotFixID property, indicating hotfix enumeration. Attackers commonly use this to gather patch and software version context during discovery. The detection relies on Script Block Logging telemetry that captures the relevant WMI query strings in executed PowerShell.
references:
  - https://github.com/411Hall/JAWS/blob/233f142fcb1488172aa74228a666f6b3c5c48f1d/jaws-enum.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hotfix_enum.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-21
tags:
  - attack.discovery
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Win32_QuickFixEngineering
      - HotFixID
  condition: selection
falsepositives:
  - Legitimate administration scripts
level: medium
license: DRL-1.1
related:
  - id: f5d1def8-1de0-4a0e-9794-1f6f27dd605c
    type: derived

What it detects

This rule flags PowerShell script block text that references the Win32_QuickFixEngineering WMI class along with the HotFixID property, indicating hotfix enumeration. Attackers commonly use this to gather patch and software version context during discovery. The detection relies on Script Block Logging telemetry that captures the relevant WMI query strings in executed PowerShell.

Known false positives

Legitimate administration scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.