Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2025•2•0•78

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe or w3wp.exe (WsusPool). This behavior is a key indicator of exploitation for critical remote code execution vulnerabilities such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.