{"id":"dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45","title":"Windows Hotfix Updates Reconnaissance Via Wmic.EXE","description":"Detects the execution of wmic with the \"qfe\" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2023-02-14","tags":["attack.execution","attack.t1047"],"technique_ids":["T1047"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat","https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml","source_sha256":"5b4fe968c052dc9a3ccf0197044b371990e0c36ce27fea1b3f3a07fd9ecfac82","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Hotfix Updates Reconnaissance Via Wmic.EXE\nid: dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45\nstatus: test\ndescription: Detects the execution of wmic with the \"qfe\" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts\nreferences:\n    - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat\n    - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-20\nmodified: 2023-02-14\ntags:\n    - attack.execution\n    - attack.t1047\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - OriginalFileName: 'wmic.exe'\n        - Image|endswith: '\\WMIC.exe'\n    selection_cli:\n        CommandLine|contains: ' qfe'\n    condition: all of selection*\nfalsepositives:\n    - Unknown\nlevel: medium\nsimulation:\n    - type: atomic-red-team\n      name: WMI Reconnaissance Software\n      technique: T1047\n      atomic_guid: 718aebaa-d0e0-471a-8241-c5afa69c7414\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"}],"data_path":"data/detection-rules/dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45.json","kind":"sigma"}