Windows Modify Registry wuStatusServer

MediumSplunk security contentThreat hunting

Windows Modify Registry wuStatusServer

The following analytic identifies suspicious modifications to the Windows Update configuration registry, specifically targeting the WUStatusServer key. It leverages data from the Endpoint datamodel to detect changes in the registry path associated with Windows Update settings. This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to bypass detection and deploy additional payloads. If confirmed malicious, this modification could allow attackers to evade defenses, potentially leading to further system compromise and persistent unauthorized access.

ATT&CK coverage

Outside the enterprise matrix

T1112Modify Registry 198 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_13

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Detection catalogue

ATT&CK coverage

Detection requirements

Detection logic