Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths like PerfLogs, Users\Public, Windows\Temp, or Appdata\Local\Temp. This activity can be indicative of malware unpacking or staging.
Sigma
