WUSA extract to system directory
wusa.exe /extract: unpacking a cabinet into a protected system directory. wusa is auto-elevating, and its /extract mode writes wherever it is told…
What it detects
wusa.exe /extract: unpacking a cabinet into a protected system directory.
wusa is auto-elevating, and its /extract mode writes wherever it is told without a prompt — which makes it a general-purpose "write a file into System32 as an unprivileged user" primitive. The standard use is to drop a DLL that an auto-elevating binary in that directory will side-load (CRYPTBASE.dll next to sysprep, migwiz or mcx2prov), turning a file write into elevated code execution.
There is no supported administrative reason to extract an update package into C:\Windows or below; servicing does that through its own pipeline. Microsoft removed /extract in later Windows 10 builds precisely because of this abuse.
MITRE ATT&CK mapping
False positives and triage
Effectively none for the system-directory target. Some enterprise software packaging does call wusa /extract, but into a staging folder under \Temp or \ProgramData — which this rule does not match.
To confirm: identify the .cab/.msu source path. A package sitting in \Users\<name>\AppData\Local\Temp with a random name is attacker staging; one under a software-distribution share may be legitimate. Then look for a DLL created in the target directory in the same second, and for the matching auto-elevating binary starting shortly after — that sequence is the side-load firing.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/wusa_extract_to_system_directory.yaml, licensed under the Apache License 2.0.
id: windows.privilege_escalation.wusa_extract_to_system_directory
version: 1.1.0
status: stable
severity: high
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1548.002, T1574.001]
description: |
`wusa.exe /extract:` unpacking a cabinet into a protected system directory.
wusa is auto-elevating, and its `/extract` mode writes wherever it is told without
a prompt — which makes it a general-purpose "write a file into System32 as an
unprivileged user" primitive. The standard use is to drop a DLL that an
auto-elevating binary in that directory will side-load (CRYPTBASE.dll next to
sysprep, migwiz or mcx2prov), turning a file write into elevated code execution.
There is no supported administrative reason to extract an update package into
`C:\Windows` or below; servicing does that through its own pipeline. Microsoft
removed `/extract` in later Windows 10 builds precisely because of this abuse.
match:
process_name_contains_any: [wusa]
# Two shapes, both auto-elevating and both used by real UAC-bypass tooling:
# /extract: into a protected system directory (the DLL side-load staging), and
# a package consumed straight out of a USER PROFILE (`wusa /quiet
# C:\Users\…\Temp\update.msu`), which is how several UACME variants work.
#
# Scoped to `\Users\` rather than "anywhere user-writable": the negative fixture
# for this rule is enterprise packaging staging a genuine .msu under
# `C:\ProgramData\`, and a wider pattern matched it. Servicing does stage packages
# in ProgramData; it does not source them from someone's profile.
command_line_regex: '(?i)(/extract:\s*"?[a-z]:\\windows|[a-z]:\\users\\[^"|]*\.(msu|cab)\b)'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Effectively none for the system-directory target. Some enterprise software
packaging does call `wusa /extract`, but into a staging folder under `\Temp` or
`\ProgramData` — which this rule does not match.
To confirm: identify the .cab/.msu source path. A package sitting in
`\Users\<name>\AppData\Local\Temp` with a random name is attacker staging; one
under a software-distribution share may be legitimate. Then look for a DLL created
in the target directory in the same second, and for the matching auto-elevating
binary starting shortly after — that sequence is the side-load firing.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.