Phoenix
Sigma IntelligenceBeta
Back to Rules
Threat Huntmediumtest

Cab File Extraction Via Wusa.EXE

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract cab using the "/extract" argument that is no longer supported.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems)Created Thu Aug 04Updated Thu Aug 1559b39960-5f9d-4a49-9cef-1e4d2c1d0cb9windows
Hunting Hypothesis
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        Image|endswith: '\wusa.exe'
        CommandLine|contains: '/extract:'
    condition: selection
False Positives

The "extract" flag still works on older 'wusa.exe' versions, which could be a legitimate use (monitor the path of the cab being extracted)

References
1
Resolving title…
web.archive.org
MITRE ATT&CK

Other

detection.threat-hunting
Related Rules
DerivedDetectionhigh

Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths

Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9
Status
test
Level
medium
Type
Threat Hunt
Created
Thu Aug 04
Modified
Thu Aug 15
Author
Nasreddine Bencherchali (Nextron Systems)
Path
rules-threat-hunting/windows/process_creation/proc_creation_win_wusa_cab_files_extraction.yml
Raw Tags
attack.executiondetection.threat-hunting
View on GitHub