Windows Process Creation: wusa.exe CAB Extraction Using Unsupported /extract Flag

Flags wusa.exe running with /extract:, a behavior consistent with CAB extraction and potential payload staging.

FreeUnreviewedSigmamediumv1

windows-process-creation-wusa-exe-cab-extraction-using-unsupported-extract-flag-59b39960

title: "Windows Process Creation: wusa.exe CAB Extraction Using Unsupported /extract Flag"
id: f561ceba-fc91-436a-b218-b78535d87385
related:
  - id: c74c0390-3e20-41fd-a69a-128f0275a5ea
    type: derived
  - id: 59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9
    type: derived
status: test
description: This rule identifies execution of wusa.exe (Windows Update Standalone Installer) with a command line containing /extract:. Such usage can indicate an attacker is extracting CAB contents to stage or retrieve payload components. It relies on Windows process creation telemetry capturing the executed image path and the command-line arguments.
references:
  - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_wusa_cab_files_extraction.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-04
modified: 2024-08-15
tags:
  - attack.execution
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \wusa.exe
    CommandLine|contains: "/extract:"
  condition: selection
falsepositives:
  - The "extract" flag still works on older 'wusa.exe' versions, which could be a legitimate use (monitor the path of the cab being extracted)
level: medium
license: DRL-1.1

What it detects

This rule identifies execution of wusa.exe (Windows Update Standalone Installer) with a command line containing /extract:. Such usage can indicate an attacker is extracting CAB contents to stage or retrieve payload components. It relies on Windows process creation telemetry capturing the executed image path and the command-line arguments.

Known false positives

The "extract" flag still works on older 'wusa.exe' versions, which could be a legitimate use (monitor the path of the cab being extracted)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.