Windows Process Creation: wusa.exe Cab Extraction From Suspicious Directory Paths
Flags wusa.exe with /extract: originating from common temp/public paths, a potential CAB-based payload unpacking behavior.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-05
- Updated
- 2026-07-30
What it detects
This rule identifies execution of wusa.exe with the /extract argument, indicating a CAB file extraction attempt. It further limits matches to executions originating from potentially suspicious locations such as PerfLogs, Users\Public, Windows\Temp, or AppData\Local\Temp. Attackers may use wusa.exe to unpack payloads from CAB files in common writable/temp areas, so correlating process creation and command-line parameters is key.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
- echotrail.iohttps://www.echotrail.io/insights/search/wusa.exe/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wusa_cab_files_extraction_from_susp_paths.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-wusa-exe-cab-extraction-from-suspicious-directory-paths-c74c0390
title: "Windows Process Creation: wusa.exe Cab Extraction From Suspicious Directory Paths"
id: b7ef46f5-27fe-4cdc-8d35-908eefc8f6ef
related:
- id: 59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9
type: derived
- id: c74c0390-3e20-41fd-a69a-128f0275a5ea
type: derived
status: test
description: This rule identifies execution of wusa.exe with the /extract argument, indicating a CAB file extraction attempt. It further limits matches to executions originating from potentially suspicious locations such as PerfLogs, Users\Public, Windows\Temp, or AppData\Local\Temp. Attackers may use wusa.exe to unpack payloads from CAB files in common writable/temp areas, so correlating process creation and command-line parameters is key.
references:
- https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
- https://www.echotrail.io/insights/search/wusa.exe/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wusa_cab_files_extraction_from_susp_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
modified: 2023-11-28
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_root:
Image|endswith: \wusa.exe
CommandLine|contains: "/extract:"
selection_paths:
CommandLine|contains:
- :\PerfLogs\
- :\Users\Public\
- :\Windows\Temp\
- \Appdata\Local\Temp\
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1