Potentially Suspicious Wuauclt Network Connection

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections. One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.