Detection rules › Sigma

Proxy Execution Via Wuauclt.EXE

Severity
high
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team
Source
upstream

Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218 System Binary Proxy Execution

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\wuauclt.exe'
OriginalFileName: wuauclt.exe

Stage 2: all of selection_cli

CommandLine|contains: RunHandlerComServer
CommandLine|contains: UpdateDeploymentProvider

Stage 3: not 1 of filter_main_*

or:
CommandLine|contains: ':\Windows\WinSxS\'
CommandLine|contains: '\UpdateDeploy.dll /ClassId '
CommandLine|contains: ' /UpdateDeploymentProvider UpdateDeploymentProvider.dll '
CommandLine|contains: ' wuaueng.dll '
CommandLine|contains: ':\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId'
CommandLine|contains: ':\Windows\UUS\amd64\UpdateDeploy.dll /ClassId'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /UpdateDeploymentProvider UpdateDeploymentProvider.dll
  • wuaueng.dll
  • :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId corpus 2 (sigma 2)
  • :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId corpus 2 (sigma 2)
  • :\Windows\WinSxS\ corpus 2 (sigma 2)
  • RunHandlerComServer
  • UpdateDeploymentProvider
  • \UpdateDeploy.dll /ClassId corpus 2 (sigma 2)
Imageends_with
  • \wuauclt.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • wuauclt.exe