wuauclt.exe
- File Path:
C:\Windows\system32\wuauclt.exe - Description: Windows Update
Hashes
| Type | Hash |
|---|---|
| MD5 | 7582BF723A39B56BCCEF2C170E330BD7 |
| SHA1 | 6A16C96B91A36893712A7EC1D505BB0777D5C122 |
| SHA256 | 69E3A2D3A61FEC056B012F73C943E078168454F4D2D3FECA2896A5E25D370739 |
| SHA384 | 977AA78AE012E13F95C5E3CB4847C0DD4059EFD428E37486BC94A3801F043E06585EF03F5CC5FBA524139DF49CDC1DD4 |
| SHA512 | 2166CD60B1461A5AF982D49D1CC926826A3768285FDAE38C31867EF825B13E76738F95610C5EE404DF8F5B8BDDB4E3949169AA9AA7468A19103C2CEC0D59648C |
| SSDEEP | 384:UNICX8nBL7pDLFlqVMnSSj27gK/2rWEIWOKD1IDBRJdq7ZYKLlmlm:qcR8SSSq7FcDI1PE1qm |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266 - Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840 - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: wuauclt.exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.14393.3659 (rs1_release_1.200410-1813)
- Product Version: 10.0.14393.3659
- Language: Language Neutral
- Legal Copyright: Microsoft Corporation. All rights reserved.
File Similarity (ssdeep match)
Possible Misuse
The following table contains possible examples of wuauclt.exe being misused. While wuauclt.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | net_connection_win_wuauclt_network_connection.yml | title: Wuauclt Network Connection |
DRL 1.0 |
| sigma | net_connection_win_wuauclt_network_connection.yml | description: Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making a network connections. One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule. |
DRL 1.0 |
| sigma | net_connection_win_wuauclt_network_connection.yml | - https://dtm.uk/wuauclt/ |
DRL 1.0 |
| sigma | net_connection_win_wuauclt_network_connection.yml | Image\|contains: wuauclt |
DRL 1.0 |
| sigma | net_connection_win_wuauclt_network_connection.yml | - Legitimate use of wuauclt.exe over the network. |
DRL 1.0 |
| sigma | proc_creation_win_lolbas_execution_of_wuauclt.yml | title: Monitoring Wuauclt.exe For Lolbas Execution Of DLL |
DRL 1.0 |
| sigma | proc_creation_win_lolbas_execution_of_wuauclt.yml | description: Adversaries can abuse wuauclt.exe (Windows Update client) to run code execution by specifying an arbitrary DLL. |
DRL 1.0 |
| sigma | proc_creation_win_lolbas_execution_of_wuauclt.yml | - https://dtm.uk/wuauclt/ |
DRL 1.0 |
| sigma | proc_creation_win_lolbas_execution_of_wuauclt.yml | CommandLine\|re: '(?i)wuauclt\.exe.*\/UpdateDeploymentProvider.*\/Runhandlercomserver' |
DRL 1.0 |
| sigma | proc_creation_win_proxy_execution_wuauclt.yml | title: Proxy Execution via Wuauclt |
DRL 1.0 |
| sigma | proc_creation_win_proxy_execution_wuauclt.yml | description: Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code. |
DRL 1.0 |
| sigma | proc_creation_win_proxy_execution_wuauclt.yml | - https://dtm.uk/wuauclt/ |
DRL 1.0 |
| sigma | proc_creation_win_proxy_execution_wuauclt.yml | - Image\|contains: wuauclt |
DRL 1.0 |
| sigma | proc_creation_win_proxy_execution_wuauclt.yml | - OriginalFileName: wuauclt.exe |
DRL 1.0 |
| sigma | proc_creation_win_susp_spoolsv_child_processes.yml | - \wuauclt.exe |
DRL 1.0 |
| sigma | proc_creation_win_susp_wuauclt.yml | description: Detects code execution via the Windows Update client (wuauclt) |
DRL 1.0 |
| sigma | proc_creation_win_susp_wuauclt.yml | - https://dtm.uk/wuauclt/ |
DRL 1.0 |
| sigma | proc_creation_win_susp_wuauclt.yml | - '\wuauclt.exe' |
DRL 1.0 |
| sigma | proc_creation_win_susp_wuauclt_cmdline.yml | description: Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags |
DRL 1.0 |
| sigma | proc_creation_win_susp_wuauclt_cmdline.yml | Image\|endswith: '\Wuauclt.exe' |
DRL 1.0 |
| sigma | proc_creation_win_susp_wuauclt_cmdline.yml | CommandLine\|endswith: '\Wuauclt.exe' |
DRL 1.0 |
| sigma | registry_event_persistence_search_order.yml | - C:\WINDOWS\system32\wuauclt.exe |
DRL 1.0 |
| LOLBAS | Wuauclt.yml | Name: wuauclt.exe |
|
| LOLBAS | Wuauclt.yml | - Command: wuauclt.exe /UpdateDeploymentProvider Full_Path_To_DLL /RunHandlerComServer |
|
| LOLBAS | Wuauclt.yml | - Path: C:\Windows\System32\wuauclt.exe |
|
| LOLBAS | Wuauclt.yml | - IOC: wuauclt run with a parameter of a DLL path |
|
| LOLBAS | Wuauclt.yml | - IOC: Suspicious wuauclt Internet/network connections |
|
| LOLBAS | Wuauclt.yml | - Link: https://dtm.uk/wuauclt/ |
|
| signature-base | apt_putterpanda.yar | $x0 = “WUAUCLT.EXE” fullword wide /* PEStudio Blacklist: strings / / score: ‘20.01’ */ | CC BY-NC 4.0 |
MIT License. Copyright (c) 2020-2021 Strontic.