detection.wiki

Detection rules › Sigma

Wusa.EXE Executed By Parent Process Located In Suspicious Location

Status
test
Severity
high
Log source
product windows, category process_creation
Author
X__Junior (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.

MITRE ATT&CK coverage

TacticTechniques
ExecutionNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Wusa.EXE Executed By Parent Process Located In Suspicious Location
id: ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99
status: test
description: |
    Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location.
    Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.
references:
    - https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
author: X__Junior (Nextron Systems)
date: 2023-11-26
modified: 2024-08-15
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\wusa.exe'
    selection_paths_1:
        ParentImage|contains:
            # Note: Add additional suspicious locations to increase coverage
            - ':\Perflogs\'
            - ':\Users\Public\'
            - ':\Windows\Temp\'
            - '\Appdata\Local\Temp\'
            - '\Temporary Internet'
    selection_paths_2:
        - ParentImage|contains|all:
              - ':\Users\'
              - '\Favorites\'
        - ParentImage|contains|all:
              - ':\Users\'
              - '\Favourites\'
        - ParentImage|contains|all:
              - ':\Users\'
              - '\Contacts\'
        - ParentImage|contains|all:
              - ':\Users\'
              - '\Pictures\'
    filter_main_msu:
        # Note: We exclude MSU extension files. A better approach is to baseline installation of updates in your env to avoid false negatives.
        CommandLine|contains: '.msu'
    condition: selection_img and 1 of selection_paths_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection_img and 1 of selection_paths_* and not 1 of filter_main_*

Stage 1: selection_img

selection_img:
    Image|endswith: '\wusa.exe'

Stage 2: selection_paths_1

selection_paths_1:
    ParentImage|contains:
        - ':\Perflogs\'
        - ':\Users\Public\'
        - ':\Windows\Temp\'
        - '\Appdata\Local\Temp\'
        - '\Temporary Internet'

Stage 3: selection_paths_2

selection_paths_2:
    - ParentImage|contains|all:
          - ':\Users\'
          - '\Favorites\'
    - ParentImage|contains|all:
          - ':\Users\'
          - '\Favourites\'
    - ParentImage|contains|all:
          - ':\Users\'
          - '\Contacts\'
    - ParentImage|contains|all:
          - ':\Users\'
          - '\Pictures\'

Stage 4: not filter_main_msu

filter_main_msu:
    CommandLine|contains: '.msu'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLinematch.msu

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \wusa.exe corpus 4 (sigma 4)
ParentImagematch
  • :\Perflogs\
  • :\Users\
  • :\Users\Public\ corpus 2 (sigma 2)
  • :\Windows\Temp\
  • \Appdata\Local\Temp\ corpus 2 (sigma 2)
  • \Contacts\
  • \Favorites\
  • \Favourites\
  • \Pictures\
  • \Temporary Internet corpus 2 (sigma 2)