Windows Proxy Execution via wuauclt.exe (UpdateDeploymentProvider/RunHandlerComServer)

title: Windows Proxy Execution via wuauclt.exe (UpdateDeploymentProvider/RunHandlerComServer)
id: 89f49e51-d3c9-45d7-84e8-72c5c4c6c3ad
related:
  - id: ba1bb0cb-73da-42de-ad3a-de10c643a5d0
    type: obsolete
  - id: d7825193-b70a-48a4-b992-8b5b3015cc11
    type: obsolete
  - id: af77cf95-c469-471c-b6a0-946c685c4798
    type: derived
status: test
description: This rule flags process creation where the Windows Update Client binary wuauclt.exe is launched with command-line parameters associated with UpdateDeploymentProvider and RunHandlerComServer. Attackers may abuse this legitimate Windows component to proxy or stage execution while blending in with expected update-related activity. The detection relies on Windows process creation telemetry, matching the image/OriginalFileName for wuauclt.exe and specific command-line substrings while excluding several known benign update deployment patterns.
references:
  - https://dtm.uk/wuauclt/
  - https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wuauclt_dll_loading.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team, Huntrule Team
date: 2020-10-12
modified: 2023-11-11
tags:
  - attack.stealth
  - attack.t1218
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wuauclt.exe
    - OriginalFileName: wuauclt.exe
  selection_cli:
    CommandLine|contains|all:
      - UpdateDeploymentProvider
      - RunHandlerComServer
  filter_main_generic:
    CommandLine|contains: " /UpdateDeploymentProvider UpdateDeploymentProvider.dll "
  filter_main_wuaueng:
    CommandLine|contains: " wuaueng.dll "
  filter_main_uus:
    CommandLine|contains:
      - :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId
      - :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId
  filter_main_winsxs:
    CommandLine|contains|all:
      - :\Windows\WinSxS\
      - "\\UpdateDeploy.dll /ClassId "
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1