Sigma rule: Wusa.EXE Executed By Parent Process Located In Suspicious Location

Rule

Title

Wusa.EXE Executed By Parent Process Located In Suspicious Location

Status

test

Level

high

Author

X__Junior (Nextron Systems)

Date

2023-11-26

Modified

2024-08-15

File

rules/windows/process_creation/proc_creation_win_wusa_susp_parent_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location.
Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.

Log source

product

windows

category

process_creation

Detection

selection_img:
    Image|endswith: '\wusa.exe'
selection_paths_1:
    ParentImage|contains:
        # Note: Add additional suspicious locations to increase coverage
        - ':\Perflogs\'
        - ':\Users\Public\'
        - ':\Windows\Temp\'
        - '\Appdata\Local\Temp\'
        - '\Temporary Internet'
selection_paths_2:
    - ParentImage|contains|all:
          - ':\Users\'
          - '\Favorites\'
    - ParentImage|contains|all:
          - ':\Users\'
          - '\Favourites\'
    - ParentImage|contains|all:
          - ':\Users\'
          - '\Contacts\'
    - ParentImage|contains|all:
          - ':\Users\'
          - '\Pictures\'
filter_main_msu:
    # Note: We exclude MSU extension files. A better approach is to baseline installation of updates in your env to avoid false negatives.
    CommandLine|contains: '.msu'
condition: selection_img and 1 of selection_paths_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution

References

• https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_wusa_susp_parent_execution.yml