HackTool - SharpWSUS/WSUSpendu Execution

About the rule

Rule Type

Standard

Rule Description

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Severity

Trouble

Rule journey

Attack chain scenario

Initial access → Privilege escalation → WSUS enumeration → Malicious update injection → Lateral movement → Execution on targets

Impact

• Unauthorized updates
• Lateral spread
• System compromise
• Network breach

Rule Requirement

Prerequisites

• Using Windows event viewer:

To enable detailed process auditing, log in to a domain controller with domain admin credentials and open the Group Policy Management Console (GPMC). Create or modify a GPO linked to the target OU, then enable Audit Process Creation and Audit Process Termination under Detailed Tracking. For deeper visibility, enable the setting Include command line in process creation events under Audit Process Creation. Finally, ensure the registry key Microsoft-Windows-Security-Auditing/Operational exists under the EventLog path to support enhanced logging.

• Using Sysmon:

Download and install Sysmon from Microsoft Sysinternals, then run it with administrator privileges using a configuration file that enables process creation monitoring. Use the <ProcessCreate> event filter in the config to capture all process creation events. Additionally, ensure the registry key Microsoft-Windows-Sysmon/Operational exists under the EventLog path to support event logging.

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

• Lateral Movement: Exploitation of Remote Services (T1210)

Security Standards

Enabling this rule will help you meet the security standard's requirement listed below:

1. NIST SP 800-53 Rev. 5 - SI-4 (System Monitoring)

Requires organizations to monitor systems for unusual or unauthorized activities.
Triggering this rule enables the detection of suspicious WSUS-related execution, helping monitor and flag potential lateral movement tactics.

2. NIST SP 800-53 Rev. 5 - AU-6 (Audit Review, Analysis, and Reporting)

Calls for regular audit log review and automated analysis for identifying security-relevant events.
Triggering this rule generates audit trails for unauthorized WSUS tool execution, supporting forensic analysis and compliance.

3. NIST SP 800-53 Rev. 5 - AC-2 (Account Management)

Emphasizes managing and controlling user account activities to prevent misuse.
Triggering this rule exposes potentially unauthorized use of elevated accounts to execute SharpWSUS/WSUSpendu utilities.

4. NIST SP 800-171 - 3.3.1 (System Audit Logs)

Requires the generation and retention of system logs to support security investigations.
Triggering this rule contributes to maintaining detailed logs of malicious WSUS usage, aiding incident response.

5. NIST CSF - DE.CM-7 (Detection Processes)

Ensures continuous monitoring for anomalous activities and potential threats.
Triggering this rule supports continuous threat detection by identifying unusual WSUS activity patterns.

Author

@Kostastsale, Nasreddine Bencherchali (Nextron Systems)

Future actions

Known False Positives

This rule will be triggered when system administrators run legitimate scripts or tools for WSUS diagnostics or internal update testing. Such activity may mimic SharpWSUS behavior but is non-malicious in intent.

Next Steps

When this rule is triggered, the following measures can be implemented:

1. Identification: Identify if the flagged event is a new incident or part of an existing incident.
2. Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
3. Response: Respond promptly by initiating an automated workflow to interrupt the network connections and cease the malicious process.
4. Containment: Isolate the affected host from the network to prevent further lateral movement or data collection attempts.
5. Eradication: Remove the SharpView tool and any associated malicious scripts or payloads from the compromised system.

Mitigation