Suspicious Process Spawn from WSUS Process
Detects the spawning of command-line interpreters (`cmd.exe` or `powershell.exe`) from processes associated with Windows Server Update Services (WSUS), such as `w3wp.exe` (IIS worker process for WSUS) and `wsusservice.exe`. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2025-59287, where attackers gain remote code execution on the WSUS server.
Sigma
