{"id":"13cfeb75-9e33-4d04-b0f7-ab8faaa95a59","title":"Windows Update Error","description":"Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.\n","author":"frack113","status":"stable","level":"informational","date":"2021-12-04","modified":"2023-09-07","tags":["attack.impact","attack.resource-development","attack.t1584"],"technique_ids":["T1584"],"logsource":{"product":"windows","service":"system"},"falsepositives":["Unknown"],"references":["https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml"],"source_path":"rules/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml","source_sha256":"349399503da437f94f99e330d1cfcc5065ae43422262468415e4988c1d7c1ecd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Update Error\nid: 13cfeb75-9e33-4d04-b0f7-ab8faaa95a59\nstatus: stable\ndescription: |\n    Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.\nreferences:\n    - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml\nauthor: frack113\ndate: 2021-12-04\nmodified: 2023-09-07\ntags:\n    - attack.impact\n    - attack.resource-development\n    - attack.t1584\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        Provider_Name: Microsoft-Windows-WindowsUpdateClient\n        EventID:\n            - 16 # Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule\n            - 20 # Installation Failure: Windows failed to install the following update with error\n            - 24 # Uninstallation Failure: Windows failed to uninstall the following update with error\n            - 213 # Revert Failure: Windows failed to revert the following update with error\n            - 217 # Commit Failure: Windows failed to commit the following update with error\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: informational\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1584","id":"T1584","name":"Compromise Infrastructure","page":"techniques/enterprise/T1584/"}],"data_path":"data/detection-rules/13cfeb75-9e33-4d04-b0f7-ab8faaa95a59.json","kind":"sigma"}