title: Suspicious Windows Update Agent Empty Cmdline
id: 52d097e2-063e-4c9c-8fbb-855c8948d135
status: experimental
description: Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags
author: Florian Roth
references:
    - https://redcanary.com/blog/blackbyte-ransomware/
date: 2022/02/26
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\Wuauclt.exe'
        CommandLine|endswith: '\Wuauclt.exe' 
    condition: selection
falsepositives:
    - Unknown
level: high
