Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process

title: Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process
id: 43259cc4-1b80-4931-bd98-baea01afc196
status: experimental
description: |
    Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe.
    This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
references:
    - https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
    - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
    - https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-31
tags:
    - attack.execution
    - attack.initial-access
    - attack.t1190
    - attack.t1203
    - cve.2025-59287
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent_wsusservice:
        ParentImage|endswith: '\wsusservice.exe'
    selection_parent_w3wp_wsuspool:
        ParentImage|endswith: '\w3wp.exe'
        ParentCommandLine|contains: 'WsusPool'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\powershell_ise.exe'
    condition: 1 of selection_parent_* and selection_child
falsepositives:
    - If this activity is expected, consider filtering based on specific command lines, user context (e.g., `nt authority\network service`), or parent process command lines to reduce noise.
level: high