
title: Monitoring Wuauclt.exe For Lolbas Execution Of DLL
author: Sreeman
date: 2020/10/29
description: Adversaries can abuse wuauclt.exe (Windows Update client) to run code
  execution by specifying an arbitrary DLL.
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine|re: (?i)wuauclt\.exe.*/UpdateDeploymentProvider.*/Runhandlercomserver
  SELECTION_3:
    CommandLine:
    - '*wuaueng.dll*'
    - '*UpdateDeploymentProvider.dll /ClassId*'
  condition: (SELECTION_1 and SELECTION_2 and  not (SELECTION_3))
falsepositives:
- Wuaueng.dll which is a module belonging to Microsoft Windows Update.
fields:
- CommandLine
id: ba1bb0cb-73da-42de-ad3a-de10c643a5d0
level: medium
logsource:
  category: process_creation
  product: windows
modified: 2021/06/11
references:
- https://dtm.uk/wuauclt/
status: experimental
tags:
- attack.defense_evasion
- attack.execution
- attack.t1085
- attack.t1218.011
ruletype: SIGMA
