Windows Update Error

Title: Windows Update Error
Status: stable
Description:Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
References:
  -https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml
Author: frack113
Date: 2021-12-04
modified:2023-09-07
Tags:

• -'attack.impact'
• -'attack.resource-development'
• -'attack.t1584'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Microsoft-Windows-WindowsUpdateClient'
    EventID:
      -'16'
      -'20'
      -'24'
      -'213'
      -'217'

  condition:selection
Falsepositives:
  -Unknown
Level: informational