WSUS--- SQL NTLM-relay coercion path (PetitPotam-style toward SUSDB)

Ankit Mehta@Secvyn

•updated Aug 8, 2026•1•0•5

This rule detects potential NTLM relay activity directed toward WSUS servers by monitoring network connections. It specifically identifies Windows devices identified as 'wsus' that communicate over both SMB (TCP 445) and Microsoft SQL Server (TCP 1433) ports within a 10-minute window, suggesting an attacker attempting to relay authentication to the WSUS backend database.