Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths

SigmaHQ Detections@sigmaHQ

•updated Aug 29, 2024•0•0•0

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.