Overview
The Hotfixes command enumerates all installed Windows updates and hotfixes via WMI. This helps identify missing security patches and potential vulnerabilities that could be exploited for privilege escalation or other attacks.Syntax
Remote Execution
Output
Returns hotfix information:- HotFix ID (KB number)
- Description
- Installed date
- Installed by (user)
Use Cases
- Red Team
- Blue Team
- Identify missing security patches
- Find exploitable vulnerabilities
- Plan privilege escalation attacks
- Assess system patch level
- Identify outdated systems
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
Low detection risk - queries WMI for installed updates.
Related Commands
- OSInfo - Operating system version information
- DotNet - .NET Framework versions
- WindowsDefender - Defender update status