Suspicious WSUS Child Process (CVE-2025-59287)

Tim P@timdetections

•updated Apr 23, 2026•1•0•319

Detects the Windows Server Update Services (WSUS) worker process (w3wp.exe) or service (wsusservice.exe) spawning command-line tools like cmd.exe or powershell.exe. This behavior is highly anomalous and strongly indicates a successful compromise, such as post-exploitation activity related to the WSUS Unauthenticated RCE (CVE-2025-59287).