huntrule

Windows System Logs: Windows Update Client errors (connection, install, uninstall, revert, commit)

Alerts on Windows Update Client errors in System logs, including connection, install, uninstall, revert, and commit failures.

FreeReviewedSigma · Informational · v2
Product
windows
Service
system
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-12-04
Updated
2026-07-31
AnalysisDetection
title: "Windows System Logs: Windows Update Client errors (connection, install, uninstall, revert, commit)"
id: 557c8093-c612-4161-a200-cba39d583c58
status: stable
description: This rule flags Windows Update Client events from the Microsoft-Windows-WindowsUpdateClient provider indicating failures to connect to the updates service or failures during install, uninstall, revert, or commit operations. Such errors matter because attackers and administrators alike may cause or mask update disruptions, preventing patches from being applied on schedule. It relies on system telemetry capturing Windows Update Client event records with the specified event IDs.
references:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml
author: frack113, Huntrule Team
date: 2021-12-04
modified: 2023-09-07
tags:
  - attack.impact
  - attack.resource-development
  - attack.t1584
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-WindowsUpdateClient
    EventID:
      - 16
      - 20
      - 24
      - 213
      - 217
  condition: selection
falsepositives:
  - Unknown
level: informational
license: DRL-1.1
related:
  - id: 13cfeb75-9e33-4d04-b0f7-ab8faaa95a59
    type: derived