LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

wuauclt.exe

View source

Windows Update Client

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Loads and executes DLL code on attach.

COMMAND
wuauclt.exe /UpdateDeploymentProvider {PATH_ABSOLUTE:.dll} /RunHandlerComServer
USE CASE
Execute dll via attach/detach methods
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · DLL
02 / ON DISK

Known paths

C:\Windows\System32\wuauclt.exe
C:\Windows\UUS\amd64\wuauclt.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    wuauclt run with a parameter of a DLL path

  • IOC

    Suspicious wuauclt Internet/network connections

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

David Middlehurst@dtmsecurity