wuauclt.exe

wuauclt.exe (Windows Update AutoUpdate Client) historically drove update detection and installation. On Windows 10 and 11 most of its job has moved to the Update Orchestrator and usoclient.exe, so it is rarely seen doing real work. The genuine binary lives at C:\Windows\System32\wuauclt.exe. Its security relevance is a parameter that loads an external DLL through an update-deployment provider interface.

Legitimately, wuauclt is invoked by the update infrastructure, infrequently on current systems. A command line that points it at a DLL is what gives a malicious instance away.

wuauclt.exe is a system-binary proxy (T1218). With the /UpdateDeploymentProvider <dll> /RunHandlerComServer form, wuauclt loads the named DLL and calls into it, so an attacker has the signed Windows Update client execute their DLL, bypassing application-control rules that trust Microsoft binaries. A wuauclt command line naming a DLL, especially one in a user-writable directory, is close to a confirmed abuse, because legitimate update activity does not look like that.

Since wuauclt does little on modern Windows, its appearance with an unusual command line or parent is itself worth attention.