detection.wiki

Detection rules › Sigma

Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application
ExecutionT1203 Exploitation for Client Execution

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process
id: 43259cc4-1b80-4931-bd98-baea01afc196
status: experimental
description: |
    Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe.
    This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
references:
    - https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
    - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
    - https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-31
tags:
    - attack.execution
    - attack.initial-access
    - attack.t1190
    - attack.t1203
    - cve.2025-59287
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent_wsusservice:
        ParentImage|endswith: '\wsusservice.exe'
    selection_parent_w3wp_wsuspool:
        ParentImage|endswith: '\w3wp.exe'
        ParentCommandLine|contains: 'WsusPool'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\powershell_ise.exe'
    condition: 1 of selection_parent_* and selection_child
falsepositives:
    - If this activity is expected, consider filtering based on specific command lines, user context (e.g., `nt authority\network service`), or parent process command lines to reduce noise.
level: high

Stages and Predicates

Stage 0: condition

1 of selection_parent_* and selection_child

Stage 1: selection_parent_wsusservice

selection_parent_wsusservice:
    ParentImage|endswith: '\wsusservice.exe'

Stage 2: selection_parent_w3wp_wsuspool

selection_parent_w3wp_wsuspool:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains: 'WsusPool'

Stage 3: selection_child

selection_child:
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\powershell_ise.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \powershell.exe corpus 182 (sigma 182)
  • \powershell_ise.exe corpus 41 (sigma 41)
  • \pwsh.exe corpus 168 (sigma 168)
ParentCommandLinematch
  • WsusPool
ParentImageends_with
  • \w3wp.exe corpus 12 (sigma 12)
  • \wsusservice.exe