Detect Microsoft WSUS Deserialization of Untrusted Data (CVE-2025-59287) in Microsoft Sentinel
Detects exploitation of CVE-2025-59287, a deserialization of untrusted data vulnerability in Microsoft Windows Server Update Services (WSUS). Successful exploitation allows an attacker to execute arbitrary code in the context of the WSUS service by sending a crafted serialized object. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild.
MITRE ATT&CK
KQL Detection Query
let wsus_processes = dynamic(["WsusPool", "UpdateServicesDbHandler", "wsusservice.exe", "W3wp.exe"]);
let suspicious_children = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "net.exe", "net1.exe", "whoami.exe", "nltest.exe"]);
union
(
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where InitiatingProcessCommandLine has_any ("WsusPool", "WSUSContent", "ApiRemoting30")
| where FileName in~ (suspicious_children)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| extend DetectionSource = "WSUS_W3WP_SuspiciousChild"
),
(
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName =~ "wsusservice.exe" or InitiatingProcessFileName =~ "w3wp.exe"
| where RemotePort !in (80, 443, 8530, 8531)
| where RemoteIPType == "Public"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| extend DetectionSource = "WSUS_UnexpectedOutboundNetwork"
),
(
SecurityEvent
| where TimeGenerated >= ago(7d)
| where EventID in (4688, 4648)
| where ParentProcessName has_any (wsus_processes)
| where NewProcessName has_any (suspicious_children)
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine
| extend DetectionSource = "WSUS_SuspiciousChildProcess"
)
| sort by TimeGenerated descDetects suspicious child processes spawned from WSUS IIS application pool (w3wp.exe with WsusPool identity) or wsusservice.exe, indicative of successful deserialization exploitation. Also monitors for unexpected outbound network connections from WSUS processes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate WSUS administrative scripts or maintenance tasks spawning cmd.exe or powershell.exe
- Patch management tooling that invokes command-line utilities under the WSUS application pool identity
- Security scanning tools that enumerate WSUS configuration via command-line utilities
- Authorized penetration testing activities targeting WSUS infrastructure
Other platforms for CVE-2025-59287
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate WSUS Deserialization Child Process Execution
Expected signal: Sysmon Event ID 1 or Windows Security Event ID 4688 showing whoami.exe process creation; EDR process tree view should show PowerShell as parent.
- Test 2WSUS Endpoint Reconnaissance via Malformed HTTP Request
Expected signal: IIS log entry for POST /ApiRemoting30/WebService.asmx with unusually large request body (cs-bytes); network capture shows malformed SOAP payload; Windows Firewall logs if enabled.
- Test 3Post-Exploitation WSUS Lateral Movement Simulation
Expected signal: Sysmon Event ID 1 entries for nltest.exe, net.exe, whoami.exe with associated command-line arguments; Windows Security Event ID 4688 if command-line auditing is enabled; EDR behavioral alert for domain trust enumeration.
- Test 4Certutil Download Cradle from WSUS Context
Expected signal: Sysmon Event ID 1 for certutil.exe with -urlcache and -f arguments; Sysmon Event ID 11 for file creation at C:\Windows\Temp\wsus_test_artifact.txt; Windows Defender SmartScreen or AMSI telemetry if enabled; EDR network event for loopback HTTP connection from certutil.exe.
Response Playbook
Triage
- Identify the WSUS server(s) involved by filtering alerts on the host name and correlate with asset inventory to confirm WSUS role assignment.
- Review the parent process command line to confirm the IIS application pool identity (WsusPool) or wsusservice.exe is the true parent, ruling out process name spoofing.
- Examine the child process command line arguments for encoded commands (base64 in PowerShell), download cradles, lateral movement utilities (net.exe, nltest.exe), or credential dumping indicators.
- Check the WSUS server's Windows Event Log (EventID 4688 with command-line auditing enabled) and Sysmon logs (EventID 1) for the full process tree around the time of the alert.
- Determine whether the WSUS server is internet-facing or accessible only from internal management networks — internet-facing WSUS significantly increases risk.
Containment
- Immediately isolate the affected WSUS server from the network (block inbound/outbound except for emergency IR access) to prevent attacker lateral movement or C2 beaconing.
- Suspend the WsusPool IIS application pool and stop the wsusservice.exe service to halt further exploitation while preserving forensic state.
- Reset credentials for any service accounts associated with WSUS (WsusPool identity, SQL service accounts used by WSUS database) and revoke any tokens or certificates that may have been exposed.
- Block known malicious IPs or domains identified in child process command lines or network connections at the perimeter firewall and DNS layer.
Evidence Collection
- Collect a full memory image of the WSUS server using a trusted forensic tool (e.g., WinPmem, Magnet RAM Capture) prior to any remediation to preserve in-memory artifacts of the deserialized payload.
- Export IIS logs from the WSUS web application (default: C:\Windows\WID\Log or IIS log path) covering the 48 hours prior to the alert, paying attention to unusual POST requests to UpdateServer or ApiRemoting30 endpoints.
- Capture Sysmon logs, Windows Security Event Logs, and PowerShell ScriptBlock logs (Event ID 4104) from the WSUS server and any hosts it communicated with around the time of the alert.
- Preserve copies of any newly created or modified files on the WSUS server, particularly in Temp directories, WSUS content directories, and IIS root paths.
Escalation Criteria
- !Escalate immediately to incident response if the child process executed a network connection to an external IP, indicating successful C2 establishment following exploitation.
- !Escalate if evidence of credential dumping (e.g., LSASS access, invocation of Mimikatz-like tooling, suspicious access to SAM/NTDS.dit) is observed following the initial WSUS process anomaly.
- !Escalate if lateral movement is detected from the WSUS server to other hosts (e.g., PsExec, WMI, SMB connections to domain controllers or other servers).
- !Escalate if the WSUS server is found to be distributing unauthorized or tampered update packages to endpoints.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS logs at %SystemRoot%\System32\LogFiles\W3SVC* showing unusual POST requests to /ApiRemoting30/WebService.asmx or /ClientWebService/client.asmx with large request bodies - >
Windows Event ID 4688 (process creation with command-line auditing) or Sysmon Event ID 1 showing cmd.exe/powershell.exe with parent w3wp.exe (WsusPool) - >
PowerShell ScriptBlock logs (Event ID 4104) containing encoded or obfuscated commands executed under the WSUS application pool identity - >
WSUS database (SUSDB) modification timestamps indicating unauthorized changes to update approvals or target group membership - >
Prefetch files (C:\Windows\Prefetch) showing execution of suspicious binaries with timestamps correlating to the exploitation window - >
Memory artifacts: injected shellcode or .NET assembly payloads recoverable from w3wp.exe process memory dump
Tuning Guidance
Reduce false positives by whitelisting known WSUS administrative scripts and their parent process command lines in your SIEM. Create a baseline of normal WSUS child processes in your environment over 30 days before enabling alerting. Correlate alerts with WSUS patch deployment schedules — spikes in child process activity during maintenance windows are typically benign. Apply additional context by enriching alerts with asset criticality data (domain controllers and Tier 0 assets WSUS-managed are higher priority). Consider suppressing net.exe and net1.exe detections if your environment's WSUS maintenance scripts legitimately invoke them, but retain detection for mshta.exe, wscript.exe, and certutil.exe which have no expected WSUS operational use.
Hunting Queries
Hunt for unexpected outbound network connections from WSUS IIS worker processes (w3wp.exe running under WsusPool) to public IP addresses or non-standard ports, which may indicate successful exploitation and C2 callback.
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where InitiatingProcessCommandLine has_any ("WsusPool", "WSUSContent", "ApiRemoting30")
| where RemoteIPType == "Public" or RemotePort !in (80, 443, 8530, 8531, 1433)
| summarize ConnectionCount=count(), Ports=make_set(RemotePort), IPs=make_set(RemoteIP) by DeviceName, InitiatingProcessCommandLine, bin(TimeGenerated, 1h)
| where ConnectionCount > 0
| sort by TimeGenerated descindex=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3
| where match(Image, "(?i)w3wp\.exe")
| where match(CommandLine, "(?i)(WsusPool|WSUSContent|ApiRemoting30)")
| where NOT match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)")
| stats count AS connection_count, values(DestinationIp) AS dest_ips, values(DestinationPort) AS dest_ports BY host, Image, CommandLine
| where connection_count > 0
| sort -connection_countHunt for file creation events from WSUS IIS worker processes dropping executables, DLLs, or scripts into temporary or user-writable directories — a strong indicator of post-exploitation payload staging.
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where InitiatingProcessCommandLine has_any ("WsusPool", "WSUSContent", "ApiRemoting30")
| where FolderPath has_any ("\\Temp\\", "\\Windows\\Temp\\", "\\Users\\Public\\", "\\ProgramData\\")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".bat"
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessCommandLine
| sort by TimeGenerated descindex=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
| where match(Image, "(?i)w3wp\.exe") AND match(CommandLine, "(?i)(WsusPool|WSUSContent|ApiRemoting30)")
| where match(TargetFilename, "(?i)(\\.exe|\\.dll|\\.ps1|\\.bat)")
| where match(TargetFilename, "(?i)(temp|public|programdata)")
| table _time, host, Image, TargetFilename, MD5
| sort -_timeAtomic Red Team Tests
Simulates the behavior of a successful WSUS deserialization exploit by launching a suspicious child process (whoami.exe) from a process impersonating the WSUS IIS worker context. This tests detection of the child process spawning pattern without requiring a live exploit.
Command
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$proc = New-Object System.Diagnostics.Process; $proc.StartInfo.FileName = 'whoami.exe'; $proc.StartInfo.Arguments = '/all'; $proc.StartInfo.UseShellExecute = $false; $proc.StartInfo.RedirectStandardOutput = $true; $proc.Start(); $proc.WaitForExit(); Write-Host $proc.StandardOutput.ReadToEnd()"Cleanup
No cleanup required — whoami.exe is a read-only system binary and leaves no persistent artifacts.Expected Telemetry
Sysmon Event ID 1 or Windows Security Event ID 4688 showing whoami.exe process creation; EDR process tree view should show PowerShell as parent.
Expected Detection
Detection rule should fire on whoami.exe spawned from PowerShell under a simulated WSUS context; adjust test to set parent process context to w3wp.exe for full simulation using a process injection harness.
Sends a crafted HTTP POST request to the WSUS ApiRemoting30 endpoint with a large body to simulate the initial delivery vector of a deserialization payload. Tests IIS logging and network-level detection of unusual WSUS traffic. Lab environment only — do not run against production WSUS.
Command
powershell.exe -NoProfile -Command "$body = [System.Text.Encoding]::UTF8.GetBytes('<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"><soap:Body><AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA></soap:Body></soap:Envelope>'); $req = [System.Net.WebRequest]::Create('http://localhost:8530/ApiRemoting30/WebService.asmx'); $req.Method = 'POST'; $req.ContentType = 'text/xml; charset=utf-8'; $req.ContentLength = $body.Length; $stream = $req.GetRequestStream(); $stream.Write($body, 0, $body.Length); $stream.Close(); try { $req.GetResponse() } catch { Write-Host \"Response: $($_.Exception.Message)\" }"Cleanup
No cleanup required — this sends a single HTTP request; IIS logs may retain the entry and can be cleared from %SystemRoot%\System32\LogFiles\W3SVC1\ if needed.Expected Telemetry
IIS log entry for POST /ApiRemoting30/WebService.asmx with unusually large request body (cs-bytes); network capture shows malformed SOAP payload; Windows Firewall logs if enabled.
Expected Detection
Network-based WAF or IDS rules should alert on oversized SOAP bodies targeting WSUS endpoints; IIS log analytics should flag anomalous request sizes to ApiRemoting30.
Simulates lateral movement activity that would follow successful WSUS exploitation by running nltest.exe and net.exe to enumerate domain trust relationships and local administrators, mimicking attacker reconnaissance behavior from a compromised WSUS server.
Command
cmd.exe /c "nltest /domain_trusts & net localgroup administrators & whoami /groups"Cleanup
No cleanup required — these are read-only enumeration commands that do not create persistent artifacts.Expected Telemetry
Sysmon Event ID 1 entries for nltest.exe, net.exe, whoami.exe with associated command-line arguments; Windows Security Event ID 4688 if command-line auditing is enabled; EDR behavioral alert for domain trust enumeration.
Expected Detection
Detections for nltest.exe /domain_trusts execution should fire; correlation with WSUS parent process context would escalate severity to critical; endpoint behavioral rules for trust enumeration chained with IIS worker process ancestry should alert.
Simulates a post-exploitation download cradle using certutil.exe, a commonly abused living-off-the-land binary, as would be observed if an attacker leveraged WSUS deserialization to pull down additional tooling. Uses a benign local file as the download target for lab safety.
Command
certutil.exe -urlcache -split -f http://127.0.0.1:8080/test.txt C:\Windows\Temp\wsus_test_artifact.txtCleanup
del /f /q C:\Windows\Temp\wsus_test_artifact.txtExpected Telemetry
Sysmon Event ID 1 for certutil.exe with -urlcache and -f arguments; Sysmon Event ID 11 for file creation at C:\Windows\Temp\wsus_test_artifact.txt; Windows Defender SmartScreen or AMSI telemetry if enabled; EDR network event for loopback HTTP connection from certutil.exe.
Expected Detection
Certutil.exe download cradle detection rules should fire; file creation in Temp by certutil.exe should trigger file-based detection; if chained with WSUS parent ancestry, alert severity should be critical.