cscli scenarios install sigmahq/proc_creation_win_wusa_cab_files_extraction_from_susp_paths1type: trigger2name: sigmahq/proc_creation_win_wusa_cab_files_extraction_from_susp_paths3description: |4 Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\wusa.exe' && evt.Parsed.CommandLine contains '/extract:' && (evt.Parsed.CommandLine contains ':\\PerfLogs\\' || evt.Parsed.CommandLine contains ':\\Users\\Public\\' || evt.Parsed.CommandLine contains ':\\Windows\\Temp\\' || evt.Parsed.CommandLine contains '\\Appdata\\Local\\Temp\\'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:1415 label: "Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths"16 behavior : "windows:audit"17 remediation: false1819scope:20 type: ParentProcessId21 expression: evt.Parsed.ParentProcessId2223