YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_HKTL_EXPL_WSUS_Exploitation_POC_Oct25

Detects POC for the exploitation of the Windows Server Update Services (WSUS) Remote Code Execution Vulnerability (CVE-2025-59287)

HacktoolSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Kompiliert mit YARA-X (mit Warnungen)

Autor: Florian Roth
Datum: 2025-10-26
Geändert: 2026-05-15
Score / Qualität: 75 / 85

Was diese Regel erkennt

Detects POC for the exploitation of the Windows Server Update Services (WSUS) Remote Code Execution Vulnerability (CVE-2025-59287)

Sie definiert 5 Muster (5 Text, 0 Hex, 0 Regex).

YARA-X meldet: warning[duplicate_pattern_value]: duplicate pattern value

Zusammenfassung aus den Metadaten und der Bedingung der Regel erzeugt.

Regelquelltext

.yar herunterladen

hktl-expl-wsus-exploitation-poc-oct25.yarDetection Rule License 1.1

rule SIGNATURE_BASE_HKTL_EXPL_WSUS_Exploitation_POC_Oct25 : CVE_2025_59287 FILE
{
	meta:
		description = "Detects POC for the exploitation of the Windows Server Update Services (WSUS) Remote Code Execution Vulnerability (CVE-2025-59287)"
		author = "Florian Roth"
		id = "3f566bda-c217-55c9-bc21-26dd26b271f5"
		date = "2025-10-26"
		modified = "2026-05-15"
		reference = "https://github.com/jiansiting/CVE-2025-59287/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_wsus_cve_2025_59287.yar#L30-L49"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "ade02afa7449f0bfcd82065a4246a598bedb46c561bf721b6bf1325fe0fc6239"
		score = 75
		quality = 85
		tags = "CVE-2025-59287, FILE"

	strings:
		$sa1 = "/SimpleAuthWebService/SimpleAuth.asmx"
		$sa2 = "/ReportingWebService/ReportingWebService.asmx"
		$sa3 = "/ClientWebService/Client.asmx"
		$sa4 = "/ReportingWebService/ReportingWebService.asmx"
		$sb1 = "xsi:type=\"SOAP-ENC:base64\">"

	condition:
		filesize < 20MB and all of ( $sa* ) and $sb1
}

Strings (5 Muster)

Bezeichner	Typ	Wert
$sa1	Text	"/SimpleAuthWebService/SimpleAuth.asmx"
$sa2	Text	"/ReportingWebService/ReportingWebService.asmx"
$sa3	Text	"/ClientWebService/Client.asmx"
$sa4	Text	"/ReportingWebService/ReportingWebService.asmx"
$sb1	Text	"xsi:type=\"SOAP-ENC:base64\">"

Bedingung

filesize < 20MB and all of ( $sa* ) and $sb1

In Worten (Heuristik)

Die Datei muss kleiner als 20MB sein (eine günstige Grenze, die große Dateien ausschließt).
Alle Muster aus ( $sa* ) müssen treffen.
Muster $sb1 muss vorhanden sein.