Windows Application Logs: WSUS deserialization exploitation indicators for CVE-2025-59287

Flags WSUS (EventID 7053) application log errors matching invalid cast/object data provider strings indicative of CVE-2025-59287 exploitation.

FreeUnreviewedSigmahighv1

windows-application-logs-wsus-deserialization-exploitation-indicators-for-cve-20-e5f66e87

title: "Windows Application Logs: WSUS deserialization exploitation indicators for CVE-2025-59287"
id: dd6db5a9-299b-479d-8366-535a230220f2
status: experimental
description: This rule looks for Windows Application log EventID 7053 entries from Windows Server Update Services that include specific invalid cast and object data provider messages commonly seen during deserialization exploitation attempts tied to CVE-2025-59287. Attackers may trigger these runtime exceptions when processing crafted payloads via WSUS, making the log context and exception strings key telemetry. It relies on the WSUS provider name, the application event id, and the presence of multiple exception-related substrings in the event data.
references:
  - https://unit42.paloaltonetworks.com/cve-2025-59287/
  - https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
  - https://github.com/0xBruno/WSUSploit.NET/tree/e239bce9d6b5f46a346e1e4c4d5e0a2a20d5c639
  - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-59287/win_wsus_exploit_cve_2025_59287.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-31
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1190
  - attack.t1203
  - cve.2025-59287
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Windows Server Update Services
    EventID: 7053
    Data|contains|all:
      - System.InvalidCastException
      - System.Windows.Data.ObjectDataProvider
      - Unable to cast object of type
      - System.Windows.Media.Brush
  condition: selection
falsepositives:
  - Legitimate WSUS operations that may trigger similar error messages
level: high
license: DRL-1.1
related:
  - id: e5f66e87-7d6b-404f-92fe-7aa67814b5cd
    type: derived

What it detects

This rule looks for Windows Application log EventID 7053 entries from Windows Server Update Services that include specific invalid cast and object data provider messages commonly seen during deserialization exploitation attempts tied to CVE-2025-59287. Attackers may trigger these runtime exceptions when processing crafted payloads via WSUS, making the log context and exception strings key telemetry. It relies on the WSUS provider name, the application event id, and the presence of multiple exception-related substrings in the event data.

Known false positives

Legitimate WSUS operations that may trigger similar error messages

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.