Threat Hunt - WSUS-remote-code-execution - CVE-2025-59287
A critical remote code execution vulnerability, CVE-2025-59287, affects Windows Server Update Services (WSUS), enabling unauthenticated attackers to execute arbitrary code via unsafe deserialization in the AuthorizationCookie. Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe. The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Microsoft Sentinel (KQL)
