wuauclt.exe

Loads and executes DLL code on attach.

Use Execute dll via attach/detach methods

wuauclt.exe /UpdateDeploymentProvider {PATH_ABSOLUTE:.dll} /RunHandlerComServer

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_wuauclt.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wuauclt_execution.yml

IOC: wuauclt run with a parameter of a DLL path

IOC: Suspicious wuauclt Internet/network connections

Refs

dtm.uk/wuauclt/

lolbas-project.github.io/lolbas/Binaries/wuauclt/