Suspicious wuauclt.exe Process Creation on Windows with Empty Command-Line Flags

title: Suspicious wuauclt.exe Process Creation on Windows with Empty Command-Line Flags
id: c1933932-a874-49dd-bba6-04f33748bd83
status: test
description: This rule flags Windows process creation events where wuauclt.exe starts without any command-line flags, as indicated by a command line that ends with Wuauclt or Wuauclt.exe. Attackers may misuse Windows Update-related executables to blend in with normal system activity while performing malicious actions. The detection relies on process creation telemetry, matching the executable image/filename and the pattern of the command line ending without arguments.
references:
  - https://redcanary.com/blog/blackbyte-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wuauclt_no_cli_flags_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-26
modified: 2023-11-11
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \Wuauclt.exe
    - OriginalFileName: Wuauclt.exe
  selection_cli:
    CommandLine|endswith:
      - Wuauclt
      - Wuauclt.exe
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 52d097e2-063e-4c9c-8fbb-855c8948d135
    type: derived