Wusa.exe Executed by Parent Process in Suspicious Location
This rule detects the execution of "wusa.exe" (Windows Update Standalone Installer) when its parent process is located in suspicious directories. Attackers may leverage wusa.exe to bypass User Account Control (UAC) and elevate privileges by duplicating its access token. The suspicious parent process locations include common temporary directories, public user folders, and specific user profile subdirectories like Favorites, Favourites, Contacts, and Pictures.
Sigma
