Suspicious Windows Update Agent Empty Cmdline

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects suspicious activity involving the Windows Update Agent (wuauclt.exe) where the process is executed without any command-line arguments. This behavior can be indicative of an adversary attempting to masquerade malicious activity by abusing a legitimate system utility.