{"id":"c649a6c7-cd8c-4a78-9c04-000fc76df954","title":"Potentially Suspicious Wuauclt Network Connection","description":"Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.\nOne could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.\n","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-10-12","modified":"2024-03-12","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"network_connection","product":"windows","definition":"Requirements: The CommandLine field enrichment is required in order for this rule to be used."},"falsepositives":["Unknown"],"references":["https://dtm.uk/wuauclt/"],"source_path":"rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml","source_sha256":"521fa79a48b8ebb6f550724cc2857eeef491942d8d39606a6f83bc1a87f06b32","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Wuauclt Network Connection\nid: c649a6c7-cd8c-4a78-9c04-000fc76df954\nstatus: test\ndescription: |\n    Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.\n    One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.\nreferences:\n    - https://dtm.uk/wuauclt/\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2020-10-12\nmodified: 2024-03-12\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: network_connection\n    product: windows\n    definition: 'Requirements: The CommandLine field enrichment is required in order for this rule to be used.'\ndetection:\n    selection:\n        Image|contains: 'wuauclt'\n        CommandLine|contains: ' /RunHandlerComServer'\n    # \"C:\\WINDOWS\\uus\\AMD64\\wuauclt.exe\" /DeploymentHandlerFullPath \\\\?\\C:\\Windows\\UUS\\AMD64\\UpdateDeploy.dll /ClassId aaa256e1-5b21-4993-9188-18f07ccb3b98 /RunHandlerComServer\n    filter_main_ip:\n        DestinationIp|cidr: # Ranges excluded based on https://github.com/SigmaHQ/sigma/blob/0f176092326ab9d1e19384d30224e5f29f760d82/rules/windows/network_connection/net_connection_win_dllhost_net_connections.yml\n            - '127.0.0.0/8'\n            - '10.0.0.0/8'\n            - '169.254.0.0/16'  # link-local address\n            - '172.16.0.0/12'\n            - '192.168.0.0/16'\n            - '::1/128'  # IPv6 loopback\n            - 'fe80::/10'  # IPv6 link-local addresses\n            - 'fc00::/7'  # IPv6 private addresses\n    filter_main_msrange:  # Sysmon\n        DestinationIp|cidr:\n            - '20.184.0.0/13' # Microsoft Corporation\n            - '20.192.0.0/10' # Microsoft Corporation\n            - '23.79.0.0/16' # Microsoft Corporation\n            - '51.10.0.0/15'\n            - '51.103.0.0/16' # Microsoft Corporation\n            - '51.104.0.0/15' # Microsoft Corporation\n            - '52.224.0.0/11' # Microsoft Corporation\n    filter_main_uus:\n        CommandLine|contains:\n            - ':\\Windows\\UUS\\Packages\\Preview\\amd64\\updatedeploy.dll /ClassId'\n            - ':\\Windows\\UUS\\amd64\\UpdateDeploy.dll /ClassId'\n    filter_main_winsxs:\n        CommandLine|contains|all:\n            - ':\\Windows\\WinSxS\\'\n            - '\\UpdateDeploy.dll /ClassId '\n    filter_main_cli_null:\n        CommandLine: null\n    filter_main_cli_empty:\n        CommandLine: ''\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/c649a6c7-cd8c-4a78-9c04-000fc76df954.json","kind":"sigma"}