Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters
Detects command-line execution patterns for SharpWSUS or WSUSpendu on Windows.
- Product
- windows
- Category
- process_creation
- Author
- @Kostastsale, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-07
- Updated
- 2026-07-31
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions whose command line matches SharpWSUS command patterns (approve/create/check/delete) or WSUSpendu parameters (Inject, PayloadArgs, PayloadFile). Such utilities can enable lateral movement by leveraging Windows Server Update Services (WSUS) misconfigurations to reach other systems beyond internal network segmentation. The detection relies on Windows process creation telemetry, specifically the CommandLine field containing the expected substrings.
Reporting behind it
- labs.nettitude.comhttps://labs.nettitude.com/blog/introducing-sharpwsus/
- github.comhttps://github.com/nettitude/SharpWSUS
- web.archive.orghttps://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters"
id: aa71afe9-392e-4c28-ab00-825a8aa6cb74
status: test
description: This rule identifies process executions whose command line matches SharpWSUS command patterns (approve/create/check/delete) or WSUSpendu parameters (Inject, PayloadArgs, PayloadFile). Such utilities can enable lateral movement by leveraging Windows Server Update Services (WSUS) misconfigurations to reach other systems beyond internal network segmentation. The detection relies on Windows process creation telemetry, specifically the CommandLine field containing the expected substrings.
references:
- https://labs.nettitude.com/blog/introducing-sharpwsus/
- https://github.com/nettitude/SharpWSUS
- https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml
author: "@Kostastsale, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"
date: 2022-10-07
modified: 2024-08-23
tags:
- attack.execution
- attack.lateral-movement
- attack.t1210
logsource:
product: windows
category: process_creation
detection:
selection_wsuspendu_inject:
CommandLine|contains: " -Inject "
selection_wsuspendu_payload:
CommandLine|contains:
- " -PayloadArgs "
- " -PayloadFile "
selection_sharpwsus_commands:
CommandLine|contains:
- " approve "
- " create "
- " check "
- " delete "
selection_sharpwsus_flags:
CommandLine|contains:
- " /payload:"
- " /payload="
- " /updateid:"
- " /updateid="
condition: all of selection_wsuspendu_* or all of selection_sharpwsus_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: b0ce780f-10bd-496d-9067-066d23dc3aa5
type: derived