Sigma rule: HackTool - SharpWSUS/WSUSpendu Execution

Rule

Title

HackTool - SharpWSUS/WSUSpendu Execution

Status

test

Level

high

Author

@Kostastsale, Nasreddine Bencherchali (Nextron Systems)

Date

2022-10-07

Modified

2024-08-23

File

rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS.
Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Log source

product

windows

category

process_creation

Detection

selection_wsuspendu_inject:
    CommandLine|contains: ' -Inject '
selection_wsuspendu_payload:
    CommandLine|contains:
        - ' -PayloadArgs '
        - ' -PayloadFile '
selection_sharpwsus_commands:
    CommandLine|contains:
        - ' approve '
        - ' create '
        - ' check '
        - ' delete '
selection_sharpwsus_flags:
    CommandLine|contains:
        - ' /payload:'
        - ' /payload='
        - ' /updateid:'
        - ' /updateid='
condition: all of selection_wsuspendu_* or all of selection_sharpwsus_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.lateral-movement
• attack.t1210

MITRE ATT&CK ids this rule names

• T1210

References

• https://labs.nettitude.com/blog/introducing-sharpwsus/
• https://github.com/nettitude/SharpWSUS
• https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml