Windows Hotfix Inventory Recon via wmic.exe qfe

title: Windows Hotfix Inventory Recon via wmic.exe qfe
id: 1e114855-ffe0-48ee-bbd8-15371e79008a
status: test
description: This rule flags process creation of wmic.exe when invoked with the "qfe" option to query installed hotfix (patch) information. Attackers often use this kind of system inventory during enumeration to assess patch levels and identify potential vulnerabilities. The detection relies on Windows process creation telemetry, matching the wmic.exe executable and the presence of the " qfe" flag in the command line.
references:
  - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
  - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2023-02-14
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: wmic.exe
    - Image|endswith: \WMIC.exe
  selection_cli:
    CommandLine|contains: " qfe"
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
simulation:
  - type: atomic-red-team
    name: WMI Reconnaissance Software
    technique: T1047
    atomic_guid: 718aebaa-d0e0-471a-8241-c5afa69c7414
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix/info.yml
license: DRL-1.1
related:
  - id: dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45
    type: derived