Possible Windows Update Error (via system)

title: Possible Windows Update Error (via system)
id: 569f91f5-9615-59da-9ad5-2edcef2a1eb3
status: stable
description: This rule detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
references:
    - https://attack.mitre.org/techniques/T1584/
    - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml
author: Huntrule Team
date: 2026-01-24
tags:
    - attack.impact
    - attack.resource-development
    - attack.t1584
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: Microsoft-Windows-WindowsUpdateClient
        EventID:
            - 16
            - 20
            - 24
            - 213
            - 217
    condition: selection
falsepositives:
    - Unknown
level: informational