{"id":"b0ce780f-10bd-496d-9067-066d23dc3aa5","title":"HackTool - SharpWSUS/WSUSpendu Execution","description":"Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS.\nWindows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.\n","author":"@Kostastsale, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-10-07","modified":"2024-08-23","tags":["attack.execution","attack.lateral-movement","attack.t1210"],"technique_ids":["T1210"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://labs.nettitude.com/blog/introducing-sharpwsus/","https://github.com/nettitude/SharpWSUS","https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml","source_sha256":"ac6432a60c71aed4dc2633f0694a5175f1dbdd41051bc53ea87b258e9583f0d8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - SharpWSUS/WSUSpendu Execution\nid: b0ce780f-10bd-496d-9067-066d23dc3aa5\nstatus: test\ndescription: |\n    Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS.\n    Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.\nreferences:\n    - https://labs.nettitude.com/blog/introducing-sharpwsus/\n    - https://github.com/nettitude/SharpWSUS\n    - https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1\nauthor: '@Kostastsale, Nasreddine Bencherchali (Nextron Systems)'\ndate: 2022-10-07\nmodified: 2024-08-23\ntags:\n    - attack.execution\n    - attack.lateral-movement\n    - attack.t1210\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_wsuspendu_inject:\n        CommandLine|contains: ' -Inject '\n    selection_wsuspendu_payload:\n        CommandLine|contains:\n            - ' -PayloadArgs '\n            - ' -PayloadFile '\n    selection_sharpwsus_commands:\n        CommandLine|contains:\n            - ' approve '\n            - ' create '\n            - ' check '\n            - ' delete '\n    selection_sharpwsus_flags:\n        CommandLine|contains:\n            - ' /payload:'\n            - ' /payload='\n            - ' /updateid:'\n            - ' /updateid='\n    condition: all of selection_wsuspendu_* or all of selection_sharpwsus_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1210","id":"T1210","name":"Exploitation of Remote Services","page":"techniques/enterprise/T1210/"}],"data_path":"data/detection-rules/b0ce780f-10bd-496d-9067-066d23dc3aa5.json","kind":"sigma"}