CmdID / Files

wuaueng.dll

Windows Update Agent file version info

Library on Windows 1 known copy with hashes 1 Sigma rule names it

Is it the real wuaueng.dll?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Update Agent

1 known copy

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wuaueng.dll · signed by Microsoft Windows

20a655250d6ea9126adbe3d064dc77b58b46bbe73c39ca551ed639a0190e9158

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wuaueng.dll

highProxy Execution Via Wuauclt.EXERoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team