Suspicious cmd.exe and PowerShell child processes of WSUS (wsusservice.exe) on Windows

Alerts when WSUS/IIS service processes spawn cmd or PowerShell interpreters, indicating potential exploitation and post-exploitation activity.

FreeUnreviewedSigmahighv1

suspicious-cmd-exe-and-powershell-child-processes-of-wsus-wsusservice-exe-on-win-43259cc4

title: Suspicious cmd.exe and PowerShell child processes of WSUS (wsusservice.exe) on Windows
id: 3ad97575-b144-4063-a0ef-7808657dd89f
status: experimental
description: This rule flags process creation where Windows Server Update Services (wsusservice.exe) or IIS worker (w3wp.exe running WsusPool) spawns a command-line interpreter such as cmd.exe, powershell.exe, pwsh.exe, or powershell_ise.exe. Spawning interactive scripting shells from service-hosted processes is a strong indicator of post-exploitation or attempted remote code execution, since these interpreters are commonly used to run follow-on commands. The detection relies on Windows process creation telemetry, matching parent process executable paths and child interpreter executable names.
references:
  - https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
  - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
  - https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-59287/proc_creation_win_exploit_cve_2025_59287.yml
author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-31
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1190
  - attack.t1203
  - cve.2025-59287
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_wsusservice:
    ParentImage|endswith: \wsusservice.exe
  selection_parent_w3wp_wsuspool:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: WsusPool
  selection_child:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \powershell_ise.exe
  condition: 1 of selection_parent_* and selection_child
falsepositives:
  - If this activity is expected, consider filtering based on specific command lines, user context (e.g., `nt authority\network service`), or parent process command lines to reduce noise.
level: high
license: DRL-1.1
related:
  - id: 43259cc4-1b80-4931-bd98-baea01afc196
    type: derived

What it detects

This rule flags process creation where Windows Server Update Services (wsusservice.exe) or IIS worker (w3wp.exe running WsusPool) spawns a command-line interpreter such as cmd.exe, powershell.exe, pwsh.exe, or powershell_ise.exe. Spawning interactive scripting shells from service-hosted processes is a strong indicator of post-exploitation or attempted remote code execution, since these interpreters are commonly used to run follow-on commands. The detection relies on Windows process creation telemetry, matching parent process executable paths and child interpreter executable names.

Known false positives

If this activity is expected, consider filtering based on specific command lines, user context (e.g., `nt authority\network service`), or parent process command lines to reduce noise.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.