Windows: SharpWSUS/WSUSpendu Process Command-Line Execution

title: "Windows: SharpWSUS/WSUSpendu Process Command-Line Execution"
id: aa71afe9-392e-4c28-ab00-825a8aa6cb74
status: test
description: This rule flags Windows process executions with command-line strings associated with SharpWSUS or WSUSpendu. These utilities can be used to move laterally via Windows Server Update Services, which can help attackers bypass network segmentation. The detection relies on process creation telemetry, specifically command-line contents containing the utility-specific verbs, flags, and injection/payload arguments.
references:
  - https://labs.nettitude.com/blog/introducing-sharpwsus/
  - https://github.com/nettitude/SharpWSUS
  - https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml
author: "@Kostastsale, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"
date: 2022-10-07
modified: 2024-08-23
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1210
logsource:
  product: windows
  category: process_creation
detection:
  selection_wsuspendu_inject:
    CommandLine|contains: " -Inject "
  selection_wsuspendu_payload:
    CommandLine|contains:
      - " -PayloadArgs "
      - " -PayloadFile "
  selection_sharpwsus_commands:
    CommandLine|contains:
      - " approve "
      - " create "
      - " check "
      - " delete "
  selection_sharpwsus_flags:
    CommandLine|contains:
      - " /payload:"
      - " /payload="
      - " /updateid:"
      - " /updateid="
  condition: all of selection_wsuspendu_* or all of selection_sharpwsus_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b0ce780f-10bd-496d-9067-066d23dc3aa5
    type: derived