Windows Process Creation: wusa.exe Cab Extraction From Suspicious Directory Paths

Flags wusa.exe with /extract: originating from common temp/public paths, a potential CAB-based payload unpacking behavior.

FreeUnreviewedSigmahighv1

windows-process-creation-wusa-exe-cab-extraction-from-suspicious-directory-paths-c74c0390

title: "Windows Process Creation: wusa.exe Cab Extraction From Suspicious Directory Paths"
id: b7ef46f5-27fe-4cdc-8d35-908eefc8f6ef
related:
  - id: 59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9
    type: derived
  - id: c74c0390-3e20-41fd-a69a-128f0275a5ea
    type: derived
status: test
description: This rule identifies execution of wusa.exe with the /extract argument, indicating a CAB file extraction attempt. It further limits matches to executions originating from potentially suspicious locations such as PerfLogs, Users\Public, Windows\Temp, or AppData\Local\Temp. Attackers may use wusa.exe to unpack payloads from CAB files in common writable/temp areas, so correlating process creation and command-line parameters is key.
references:
  - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://www.echotrail.io/insights/search/wusa.exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wusa_cab_files_extraction_from_susp_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
modified: 2023-11-28
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_root:
    Image|endswith: \wusa.exe
    CommandLine|contains: "/extract:"
  selection_paths:
    CommandLine|contains:
      - :\PerfLogs\
      - :\Users\Public\
      - :\Windows\Temp\
      - \Appdata\Local\Temp\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies execution of wusa.exe with the /extract argument, indicating a CAB file extraction attempt. It further limits matches to executions originating from potentially suspicious locations such as PerfLogs, Users\Public, Windows\Temp, or AppData\Local\Temp. Attackers may use wusa.exe to unpack payloads from CAB files in common writable/temp areas, so correlating process creation and command-line parameters is key.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.