Proxy Execution Via Wuauclt.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND ((PROCESSNAME endswith "\wuauclt.exe" OR ORIGINALFILENAME = "wuauclt.exe") AND (COMMANDLINE contains "UpdateDeploymentProvider" AND COMMANDLINE contains "RunHandlerComServer")) AND (COMMANDLINE notcontains " /UpdateDeploymentProvider UpdateDeploymentProvider.dll " AND COMMANDLINE notcontains " wuaueng.dll " AND COMMANDLINE notcontains ":\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId,:\Windows\UUS\amd64\UpdateDeploy.dll /ClassId" AND (COMMANDLINE notcontains ":\Windows\WinSxS" OR COMMANDLINE notcontains "\UpdateDeploy.dll /ClassId ")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team
