Exploitation Activity of CVE-2025-59287 - WSUS Deserialization

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2025•2•0•43

Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS. The rule specifically looks for `System.InvalidCastException` and `System.Windows.Data.ObjectDataProvider` along with `Unable to cast object of type` and `System.Windows.Media.Brush` within EventID 7053 from the 'Windows Server Update Services' provider.