WSUS-as-malware-delivery (.txt/.esd signature-check bypass)
Detects the creation of suspicious file types (.txt, .esd) within Windows Update (WSUS) content or download directories, specifically when initiated by standard Windows update-related processes (wuauclt.exe, TrustedInstaller.exe, or svchost.exe). This pattern may indicate an attempt to blend malicious activity with legitimate update mechanisms or an abuse of update file paths for payload delivery.
Microsoft Sentinel (KQL)
