Windows PowerShell Hotfix Enumeration via Win32_QuickFixEngineering
Detects PowerShell scripts enumerating installed hotfixes by querying Win32_QuickFixEngineering for HotFixID.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-21
- Updated
- 2026-07-31
What it detects
This rule identifies PowerShell script block content that queries Win32_QuickFixEngineering and includes HotFixID, which is commonly used to enumerate installed hotfixes. Enumerating system patch levels helps attackers assess exposure and tailor follow-on actions. It relies on PowerShell Script Block Logging telemetry capturing the referenced WMI class and the HotFixID field within the same script block.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
powershell-hotfix-enumeration-via-win32-quickfixengineering-f5d1def8
title: Windows PowerShell Hotfix Enumeration via Win32_QuickFixEngineering
id: daffc04d-236c-4ff8-8266-64bbfd66f101
status: test
description: This rule identifies PowerShell script block content that queries Win32_QuickFixEngineering and includes HotFixID, which is commonly used to enumerate installed hotfixes. Enumerating system patch levels helps attackers assess exposure and tailor follow-on actions. It relies on PowerShell Script Block Logging telemetry capturing the referenced WMI class and the HotFixID field within the same script block.
references:
- https://github.com/411Hall/JAWS/blob/233f142fcb1488172aa74228a666f6b3c5c48f1d/jaws-enum.ps1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hotfix_enum.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-21
tags:
- attack.discovery
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- Win32_QuickFixEngineering
- HotFixID
condition: selection
falsepositives:
- Legitimate administration scripts
level: medium
license: DRL-1.1
related:
- id: f5d1def8-1de0-4a0e-9794-1f6f27dd605c
type: derived