SIGNATURE_BASE_EXPL_WSUS_Exploitation_Indicators_Oct25

rule SIGNATURE_BASE_EXPL_WSUS_Exploitation_Indicators_Oct25 : CVE_2025_59287
{
	meta:
		description = "Detects indicators related to the exploitation of the Windows Server Update Services (WSUS) Remote Code Execution Vulnerability (CVE-2025-59287)"
		author = "Florian Roth"
		id = "9a118d85-fbcd-5476-acd8-6bf66f660368"
		date = "2025-10-25"
		modified = "2026-05-15"
		reference = "https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_wsus_cve_2025_59287.yar#L1-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "04487cca15f4151bfc31279fd58dc6898e59149cabb6dbef08c1df88418ab904"
		score = 75
		quality = 85
		tags = "CVE-2025-59287"

	strings:
		$sl1 = "at System.Data.DataSet.DeserializeDataSetSchema(SerializationInfo info, StreamingContext context" ascii wide
		$sl2 = "at System.Runtime.Serialization.ObjectManager.DoFixups()" ascii wide
		$sl3 = "at System.Runtime.Serialization.ObjectManager.CompleteISerializableObject" ascii wide
		$sl4 = "System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation." ascii wide
		$sl5 = "ErrorWsusService.9HmtWebServices.CheckReportingWebServiceReporting WebService WebException:System.Net.WebException: Unable to connect to the remote server" ascii wide
		$se1 = "powershell -ec try{$r= (&{echo https://" ascii wide base64 base64wide
		$se2 = ":8531; net user /domain; ipconfig " ascii wide base64 base64wide
		$sa1 = "whoami;net user /domain" ascii wide base64 base64wide
		$sa2 = "net user /domain; ipconfig /all" ascii wide base64 base64wide

	condition:
		all of ( $sl* ) or 1 of ( $se* ) or all of ( $sa* )
}