Windows Hotfix Updates Reconnaissance Via Wmic.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Windows Hotfix Updates Reconnaissance Via Wmic.EXE
id: dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45
status: test
description: Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts
references:
    - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
    - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-20
modified: 2023-02-14
tags:
    - attack.execution
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - OriginalFileName: 'wmic.exe'
        - Image|endswith: '\WMIC.exe'
    selection_cli:
        CommandLine|contains: ' qfe'
    condition: all of selection*
falsepositives:
    - Unknown
level: medium
simulation:
    - type: atomic-red-team
      name: WMI Reconnaissance Software
      technique: T1047
      atomic_guid: 718aebaa-d0e0-471a-8241-c5afa69c7414
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection*

Stage 1: `selection_img`

selection_img:
    - OriginalFileName: 'wmic.exe'
    - Image|endswith: '\WMIC.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: ' qfe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`qfe`	`field:"CommandLine" kind:match value:" qfe"`
`Image`	ends_with	`\WMIC.exe` corpus 62 (sigma 62)	`field:"Image" kind:ends_with value:"\WMIC.exe"`
`OriginalFileName`	eq	`wmic.exe` corpus 80 (sigma 38, elastic 24, splunk 18)	`field:"OriginalFileName" kind:eq value:"wmic.exe"`