Windows: Detect wusa.exe Cab Extraction Using /extract
Flags wusa.exe running with /extract:, a behavior consistent with CAB extraction and potential payload staging.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-04
- Updated
- 2026-07-31
What it detects
This rule flags process executions of wusa.exe where the command line contains the /extract: argument, indicating CAB extraction behavior. Attackers may use this built-in Windows utility to unpack installer contents during staging or delivery. The detection relies on Windows process creation telemetry, specifically the executable path ending in \wusa.exe and the presence of /extract: in the command line.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_wusa_cab_files_extraction.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-wusa-exe-cab-extraction-using-unsupported-extract-flag-59b39960
title: "Windows: Detect wusa.exe Cab Extraction Using /extract"
id: f561ceba-fc91-436a-b218-b78535d87385
related:
- id: c74c0390-3e20-41fd-a69a-128f0275a5ea
type: derived
- id: 59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9
type: derived
status: test
description: "This rule flags process executions of wusa.exe where the command line contains the /extract: argument, indicating CAB extraction behavior. Attackers may use this built-in Windows utility to unpack installer contents during staging or delivery. The detection relies on Windows process creation telemetry, specifically the executable path ending in \\wusa.exe and the presence of /extract: in the command line."
references:
- https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_wusa_cab_files_extraction.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-04
modified: 2024-08-15
tags:
- attack.execution
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \wusa.exe
CommandLine|contains: "/extract:"
condition: selection
falsepositives:
- The "extract" flag still works on older 'wusa.exe' versions, which could be a legitimate use (monitor the path of the cab being extracted)
level: medium
license: DRL-1.1