Suspicious ImageLoad via Windows Update Auto Update Client

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  (process.pe.original_file_name == "wuauclt.exe" or process.name : "wuauclt.exe") and
   process.parent.executable != null and
   process.args : "/RunHandlerComServer" and process.args : "/UpdateDeploymentProvider" and
   not process.parent.executable :
                    ("?:\\Windows\\System32\\svchost.exe",
                     "?:\\Windows\\System32\\MoUsoCoreWorker.exe",
                     "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
                     "\\Device\\HarddiskVolume*\\Windows\\System32\\MoUsoCoreWorker.exe")]
 [library where
  not (dll.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") and dll.code_signature.trusted == true) and
  not (dll.code_signature.trusted == true and
       dll.path : ("?:\\Program Files\\*.dll",
                  "?:\\Program Files (x86)\\*.dll",
                  "?:\\Windows\\System32\\*.dll",
                  "?:\\Windows\\SysWOW64\\*.dll",
                  "?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\*.dll")) and
  not dll.hash.sha256 : "dde77d27a7cb0189a9a3314e42f10666a2f69ca2b81ad03ae0cc9035a97a55ad"]