Cab File Extraction Via Wusa.EXE
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility with the "/extract" argument. This method was historically used by malware to extract cabinet files, and while it may still function on older Windows versions, it is generally not a supported or common legitimate use case in modern systems.
Sigma
