Wusa.EXE Executed By Parent Process Located In Suspicious Location (via process_creation)

This rule detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in an anomalous location. Attackers could instantiate an instance of "wusa.exe" to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.