CVE-2025-59374 Elastic Security · Elastic

Detect ASUS Live Update Embedded Malicious Code (CVE-2025-59374) in Elastic Security

Detects indicators of compromise related to CVE-2025-59374, a supply chain attack where ASUS Live Update software contained embedded malicious code (CWE-506). This mirrors the ShadowHammer operation pattern where threat actors compromised the ASUS software update infrastructure to deliver backdoored updates to endpoints. Detection focuses on suspicious child processes spawned by ASUS Live Update, anomalous network connections, and staging activity consistent with backdoor execution.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Lateral Movement Command and Control

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and process.parent.name : ("LiveUpdate.exe", "LivaUpdate.exe", "AsusLiveUpdate.exe")
    and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "schtasks.exe", "sc.exe")]
  [any where event.category : ("network", "file") and
    (
      (event.category == "network" and destination.port in (80, 443, 4444, 8080, 8443, 1337)) or
      (event.category == "file" and file.path : ("*\\Temp\\*", "*\\AppData\\Local\\Temp\\*", "*\\ProgramData\\*"))
    )]
critical severity high confidence

EQL sequence detecting ASUS Live Update spawning a suspicious child process followed within 5 minutes by network activity or suspicious file writes, indicating multi-stage backdoor execution.

Data Sources

Elastic Endpoint SecurityElastic Agent

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.network-*logs-endpoint.events.file-*

False Positives & Tuning

  • Legitimate patching workflows that write temporary files during ASUS update installation
  • Security tools inspecting ASUS update binaries and generating correlated network events
  • Automated software inventory tools triggered post-update

Other platforms for CVE-2025-59374

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate ASUS Live Update Spawning CMD Child Process

    Expected signal: Sysmon Event ID 1 showing LiveUpdate.exe as parent of cmd.exe; DeviceProcessEvents in MDE showing the parent-child relationship with command-line arguments

  2. Test 2Simulate ASUS Live Update Network Beacon

    Expected signal: Sysmon Event ID 3 or DeviceNetworkEvents showing LiveUpdate.exe initiating outbound HTTP connection to external IP; DNS query logs for associated domain lookups

  3. Test 3Simulate ASUS Live Update Dropping Payload to Temp

    Expected signal: Sysmon Event ID 11 (FileCreate) showing executable written to TEMP directory; DeviceFileEvents in MDE capturing the file drop with SHA256 hash

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify all endpoints running ASUS Live Update by querying asset inventory or EDR; prioritize endpoints where the process has spawned child processes or established outbound connections.
  2. Collect the SHA256 hash of the ASUS Live Update binary present on affected systems and compare against known-good hashes from the vendor advisory at https://www.asus.com/support/faq/1018727/.
  3. Review process tree for any child processes spawned by LiveUpdate.exe within the past 30 days; flag any LOLBINs (cmd, powershell, certutil, mshta, rundll32) and document command-line arguments.
  4. Inspect network connection logs for outbound connections from LiveUpdate.exe to non-ASUS infrastructure, particularly to uncommon geolocations or IPs not associated with ASUS CDN ranges.

Containment

  1. Immediately isolate affected endpoints from the network using EDR isolation or VLAN quarantine to prevent lateral movement or further C2 communication from the backdoored ASUS Live Update binary.
  2. Block execution of ASUS Live Update binaries via application control policy (e.g., AppLocker, CrowdStrike prevention policy) enterprise-wide until the clean version is confirmed and distributed.

Evidence Collection

  1. Capture a full memory dump of any running ASUS Live Update process on affected hosts using tools such as WinPmem or built-in EDR memory acquisition to preserve in-memory indicators of the embedded payload.
  2. Collect prefetch files, event logs (Security, System, Sysmon), and scheduled task configurations from affected endpoints; archive the ASUS Live Update binary for forensic analysis.

Escalation Criteria

  • !Escalate immediately if any endpoint shows signs of lateral movement (e.g., SMB connections, credential dumping tools, domain replication activity) originating from the affected host following ASUS Live Update execution.
  • !Escalate if the malicious ASUS Live Update binary is confirmed to have been distributed via the organization's internal software deployment system (SCCM, Intune, PDQ), indicating broader supply chain exposure.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >ASUS Live Update binary SHA256 hash — compare against ASUS vendor advisory for known-bad hashes
  • >Prefetch entries for LiveUpdate.exe and any child processes (C:\Windows\Prefetch\)
  • >Windows Event Log ID 4688 (process creation) entries with LiveUpdate.exe as parent
  • >Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) for LiveUpdate.exe
  • >Registry run keys or scheduled tasks created during or after ASUS Live Update execution

Tuning Guidance

Tune by building an allowlist of known-good ASUS Live Update child processes and network destinations (ASUS CDN hostnames/IP ranges). Suppress alerts for endpoints where the ASUS binary hash matches the clean version confirmed by the vendor. In environments where ASUS hardware is not present, suppress all ASUS Live Update detections and alert on the process name itself as anomalous. Adjust lookback window based on the disclosed date of 2025-12-17 to focus historical hunting efforts.

Hunting Queries

Hunt for files dropped by ASUS Live Update into suspicious staging directories — a common indicator of the embedded dropper component associated with CVE-2025-59374.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated >= ago(60d)
| where InitiatingProcessFileName =~ 'LiveUpdate.exe'
| where FolderPath has_any (@'\Temp\', @'\AppData\Local\Temp\', @'\ProgramData\')
| where FileName endswith '.exe' or FileName endswith '.dll' or FileName endswith '.ps1' or FileName endswith '.bat'
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessCommandLine
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(Image, "(?i)liveupdate")
| where match(TargetFilename, "(?i)(\.exe|\.dll|\.ps1|\.bat)")
| where match(TargetFilename, "(?i)(temp|appdata|programdata)")
| table _time, host, Image, TargetFilename, CreationUtcTime

Atomic Red Team Tests

Test 1 Simulate ASUS Live Update Spawning CMD Child Process
windows

Simulates the CVE-2025-59374 pattern by launching a renamed copy of cmd.exe as a child of a process named LiveUpdate.exe to test detection of suspicious parent-child relationships.

Command

powershell 
Copy-Item C:\Windows\System32\cmd.exe $env:TEMP\LiveUpdate.exe -Force; Start-Process $env:TEMP\LiveUpdate.exe -ArgumentList '/c whoami && ipconfig /all > C:\Temp\asus_test_output.txt' -Wait

Cleanup

powershell 
Remove-Item $env:TEMP\LiveUpdate.exe -Force -ErrorAction SilentlyContinue; Remove-Item C:\Temp\asus_test_output.txt -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing LiveUpdate.exe as parent of cmd.exe; DeviceProcessEvents in MDE showing the parent-child relationship with command-line arguments

Expected Detection

Alert triggered on KQL/SPL query matching LiveUpdate.exe parent spawning cmd.exe child process

Test 2 Simulate ASUS Live Update Network Beacon
windows

Simulates outbound C2 beacon behavior by having a process named LiveUpdate.exe establish a connection to a non-ASUS external IP, mimicking the network behavior of the CVE-2025-59374 backdoor.

Command

powershell 
Copy-Item C:\Windows\System32\curl.exe $env:TEMP\LiveUpdate.exe -Force; Start-Process $env:TEMP\LiveUpdate.exe -ArgumentList '-s -o NUL http://93.184.216.34/' -Wait

Cleanup

powershell 
Remove-Item $env:TEMP\LiveUpdate.exe -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 3 or DeviceNetworkEvents showing LiveUpdate.exe initiating outbound HTTP connection to external IP; DNS query logs for associated domain lookups

Expected Detection

Alert triggered on network connection query detecting LiveUpdate.exe connecting to non-ASUS infrastructure on port 80/443

Test 3 Simulate ASUS Live Update Dropping Payload to Temp
windows

Simulates the file-drop behavior of the CVE-2025-59374 embedded malicious code by writing an executable file to a temp directory from a process named LiveUpdate.exe.

Command

powershell 
Copy-Item C:\Windows\System32\notepad.exe $env:TEMP\LiveUpdate.exe -Force; Start-Process $env:TEMP\LiveUpdate.exe; Start-Sleep -Seconds 2; Copy-Item C:\Windows\System32\calc.exe $env:TEMP\svchost32.exe -Force; Write-Output 'Payload dropped to temp'

Cleanup

powershell 
Stop-Process -Name LiveUpdate -ErrorAction SilentlyContinue; Remove-Item $env:TEMP\LiveUpdate.exe -Force -ErrorAction SilentlyContinue; Remove-Item $env:TEMP\svchost32.exe -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate) showing executable written to TEMP directory; DeviceFileEvents in MDE capturing the file drop with SHA256 hash

Expected Detection

Hunting query alert on file creation event in temp/staging path initiated by LiveUpdate.exe process

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0008Lateral MovementTA0011Command and Control

Related Techniques

T1195.002Compromise Software Supply ChainT1204.002Malicious FileT1059.001PowerShellT1071.001Web ProtocolsT1053.005Scheduled Task

Same Tactic: Initial Access

Popular Detections