wuauclt.exe

Windows Update file version info (xCyclopedia)

LOLBAS Execute 3 Sigma rules name it 1 ATT&CK technique 1 documented command 11 known copies with hashes

How wuauclt.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-updatedeploymentprovider

-runhandlercomserver

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wuauclt.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Loads and executes DLL code on attach.

wuauclt.exe /UpdateDeploymentProvider {PATH_ABSOLUTE:.dll} /RunHandlerComServer

Identify

Trips 1 Sigma rule: highProxy Execution Via Wuauclt.EXE by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for wuauclt.exe, by David Middlehurst, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wuauclt.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highProxy Execution Via Wuauclt.EXERoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team

highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)

highSuspicious Windows Update Agent Empty CmdlineFlorian Roth (Nextron Systems)

T1218System Binary Proxy Execution

Is it the real wuauclt.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Update

11 known copies

10.0.22000.194 (WinBuild.160101.0800) · C:\WINDOWS\system32\wuauclt.exe · signed by Microsoft Windows

ea1d3f4ae01ea1bf8e3b3839958afdc9531110c982f30ab6fac945bd79dd93ad

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\system32\wuauclt.exe · signed by Microsoft Windows

6390c42f0dd21c9611d2eb9c7929f5213a95438d4fbfe0d4ea2adf1271f0696f

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\wuauclt.exe · signed by Microsoft Windows

4eac7348e16bd3efe323ae3cee6681246c6fcab53597892ebb43c7e7450898e4

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\wuauclt.exe · signed by Microsoft Windows

ac52d02086b83a2fa92e305e1eacd490101d08be6c47210989baa192e030dc06

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\wuauclt.exe · signed by Microsoft Windows

3bf0c76dd0b3fa97c14e765e5b0c02eb4fc6bcd539ea382b8a70e994749a5dd7

10.0.19041.1288 (WinBuild.160101.0800) · C:\Windows\system32\wuauclt.exe · signed by Microsoft Windows

d25642f358b16b5c6053d2b4ac9814579fb3f91359bd7e73f373d231d842b6ae

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\system32\wuauclt.exe · signed by Microsoft Windows

62aff13b933c69c3cf2dbc4d29fe2d7c19e15226d65652455726b08be66ad94c

10.0.17763.1457 (WinBuild.160101.0800) · C:\Windows\system32\wuauclt.exe · signed by Microsoft Windows

6858c6b1f3c45f9788c9988ef6319483d9c7aebbc5b59daf71c2f4208997b59a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wuauclt.exe · signed by Microsoft Windows

cc855323b6ab7259c92bd1310211dd95174e43be2f46c828e38f0060dd2e4488

10.0.14393.3659 (rs1_release_1.200410-1813) · C:\Windows\system32\wuauclt.exe · signed by Microsoft Windows

69e3a2d3a61fec056b012f73c943e078168454f4d2d3feca2896a5e25d370739

7.9.9600.19670 (winblue_ltsb.200307-0600) · C:\windows\system32\wuauclt.exe · signed by Microsoft Windows

4d781547bb37e50919d6a8598277dc9de7dd5ed4378cbaf87cda98e48587e31e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.