Proxy Execution Via Wuauclt.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•13

Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution of other commands or binaries. Adversaries may abuse this legitimate Windows binary to bypass defenses and execute malicious code. The rule specifically looks for wuauclt.exe being executed with command-line arguments that indicate proxy execution, while filtering out common legitimate uses of the binary related to Windows Update deployment.