CmdID / Files

UpdateDeploymentProvider.dll

Update Deployment Provider file version info

Library on Windows 1 known copy with hashes 1 Sigma rule names it

Is it the real UpdateDeploymentProvider.dll?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionUpdate Deployment Provider

1 known copy

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\UpdateDeploymentProvider.dll · signed by Microsoft Windows

7f2159d4d92d9e34d80aae590ea8a5943089848a7f31473c6ae93ac62b4bb26f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name UpdateDeploymentProvider.dll

highProxy Execution Via Wuauclt.EXERoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team