Windows Hotfix Updates Reconnaissance Via Wmic.EXE — Detection Rule
Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts