From e2b70a2edbf62bef9b81383115ebd79e4197eb6f Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Sat, 4 Dec 2021 13:02:12 +0100
Subject: [PATCH] add win_susp_system_update_error rule

---
 .../system/win_susp_system_update_error.yml   | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 rules/windows/builtin/system/win_susp_system_update_error.yml

diff --git a/rules/windows/builtin/system/win_susp_system_update_error.yml b/rules/windows/builtin/system/win_susp_system_update_error.yml
new file mode 100644
index 000000000..8f38e6893
--- /dev/null
+++ b/rules/windows/builtin/system/win_susp_system_update_error.yml
@@ -0,0 +1,27 @@
+title: Windows Update Error
+id: 13cfeb75-9e33-4d04-b0f7-ab8faaa95a59
+status: experimental
+description: Windows Update get some error Check if need a 0-days KB
+author: frack113
+date: 2021/12/04
+logsource:
+  product: windows
+  service: system
+  definition: Other error are in Microsoft-Windows-WindowsUpdateClient/Operational
+detection:
+  selection:
+    Provider_Name: Microsoft-Windows-WindowsUpdateClient
+    EventID: 
+        - 16 # Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule
+        - 20 # Installation Failure: Windows failed to install the following update with error
+        - 24 # Uninstallation Failure: Windows failed to uninstall the following update with error
+        - 213 # Revert Failure: Windows failed to revert the following update with error
+        - 217 # Commit Failure: Windows failed to commit the following update with error
+  condition: selection
+falsepositives:
+  - unknown
+level: low
+tags:
+  - attack.impact
+  - attack.resource_development
+  - attack.t1584