Windows System Log: Windows Update Client Errors (Installation/Connection/Revert)

title: "Windows System Log: Windows Update Client Errors (Installation/Connection/Revert)"
id: 557c8093-c612-4161-a200-cba39d583c58
status: stable
description: This rule flags Windows Update Client events indicating update workflow failures, including inability to connect to the automatic updates service, installation failures, uninstallation failures, revert failures, and commit failures. Attackers can disrupt patching and maintenance by preventing updates from being installed or fully rolled back. The detection relies on Windows System log telemetry from the Microsoft-Windows-WindowsUpdateClient provider with specific event IDs indicating these error conditions.
references:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml
author: frack113, Huntrule Team
date: 2021-12-04
modified: 2023-09-07
tags:
  - attack.impact
  - attack.resource-development
  - attack.t1584
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-WindowsUpdateClient
    EventID:
      - 16
      - 20
      - 24
      - 213
      - 217
  condition: selection
falsepositives:
  - Unknown
level: informational
license: DRL-1.1
related:
  - id: 13cfeb75-9e33-4d04-b0f7-ab8faaa95a59
    type: derived