HackTool - SharpWSUS/WSUSpendu Execution

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•0•13

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. These tools leverage Windows Server Update Services (WSUS) to achieve lateral movement, often by injecting malicious payloads or approving updates to distribute malware. The rule specifically looks for command-line arguments indicative of these tools' operations, such as '-Inject', '-PayloadArgs', '-PayloadFile' for WSUSpendu, and 'approve', 'create', 'check', 'delete', '/payload:', '/updateid:' for SharpWSUS.