Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_HKTL_EXPL_WSUS_Exploitation_POC_Oct25

Detects POC for the exploitation of the Windows Server Update Services (WSUS) Remote Code Execution Vulnerability (CVE-2025-59287)

Hack toolSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X (with warnings)
Author
Florian Roth
Date
2025-10-26
Modified
2026-05-15
Score / Quality
75 / 85

What this rule detects

Detects POC for the exploitation of the Windows Server Update Services (WSUS) Remote Code Execution Vulnerability (CVE-2025-59287)

It defines 5 patterns (5 text, 0 hex, 0 regex).

YARA-X says: warning[duplicate_pattern_value]: duplicate pattern value

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
hktl-expl-wsus-exploitation-poc-oct25.yarDetection Rule License 1.1
rule SIGNATURE_BASE_HKTL_EXPL_WSUS_Exploitation_POC_Oct25 : CVE_2025_59287 FILE
{
	meta:
		description = "Detects POC for the exploitation of the Windows Server Update Services (WSUS) Remote Code Execution Vulnerability (CVE-2025-59287)"
		author = "Florian Roth"
		id = "3f566bda-c217-55c9-bc21-26dd26b271f5"
		date = "2025-10-26"
		modified = "2026-05-15"
		reference = "https://github.com/jiansiting/CVE-2025-59287/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_wsus_cve_2025_59287.yar#L30-L49"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "ade02afa7449f0bfcd82065a4246a598bedb46c561bf721b6bf1325fe0fc6239"
		score = 75
		quality = 85
		tags = "CVE-2025-59287, FILE"

	strings:
		$sa1 = "/SimpleAuthWebService/SimpleAuth.asmx"
		$sa2 = "/ReportingWebService/ReportingWebService.asmx"
		$sa3 = "/ClientWebService/Client.asmx"
		$sa4 = "/ReportingWebService/ReportingWebService.asmx"
		$sb1 = "xsi:type=\"SOAP-ENC:base64\">"

	condition:
		filesize < 20MB and all of ( $sa* ) and $sb1
}

Strings (5 patterns)

IdentifierTypeValueModifiers
$sa1text"/SimpleAuthWebService/SimpleAuth.asmx"
$sa2text"/ReportingWebService/ReportingWebService.asmx"
$sa3text"/ClientWebService/Client.asmx"
$sa4text"/ReportingWebService/ReportingWebService.asmx"
$sb1text"xsi:type=\"SOAP-ENC:base64\">"

Condition

filesize < 20MB and all of ( $sa* ) and $sb1

In plain words (Heuristic)

  • The file must be smaller than 20MB (a cheap guard that skips large files).
  • All patterns in ( $sa* ) must match.
  • Pattern $sb1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Florian Roth

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 3f566bda-c217-55c9-bc21-26dd26b271f5

Tags:CVE_2025_59287FILE

Related rules