name: Suspicious WSUS Spawning Command Shell for Reconnaissance Analytic
signatureid: EDR-SYM858-RUN
category: "Execution"
threatname: "Command & Scripting Interpreter: Windows Command Shell"
functionality: "Endpoint Management Systems"
description: |
Detects the spawning of a Windows command shell, PowerShell, or reconnaissance tools by the IIS worker
process (w3wp.exe) or WSUS Service (wsusservice.exe). This behavior is a strong indicator of a successful
web application exploit, such as the deserialization vulnerability in WSUS (CVE-2025-59287), where an
attacker gains remote code execution. The detection captures both the IIS worker process compromise and
direct WSUS service process spawning, which are common post-exploitation behaviors.
reference:
- https://research.eye.security/wsus-deserialization-exploit-in-the-wild-cve-2025-59287/
- https://www.linkedin.com/posts/johnhammond010_weve-been-seeing-some-of-the-wsus-cve-2025-activity-7387528448145186816-2bDC?utm_source=share&utm_medium=member_desktop
- https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
- https://www.security.com/threat-intelligence/ransomware-spirals-extortion
labels:
- attack.execution
- attack.t1059.003
- attack.discovery
- attack.t1033
- CVE-2025-59287
- WSUS
- Spirals_Ransomware
logsource:
category: process_creation
product: windows
detection:
selection1:
ParentImage|endswith:
- '\w3wp.exe'
- '\wsusservice.exe'
selection2:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\powershell_ise.exe'
- '\whoami.exe'
- '\net.exe'
- '\net1.exe'
condition: selection1 and selection2
criticality: High
saveasthreat: false
violation_summary:
grouping_attribute: "AccountName"
level2_attribute:
level2_metadata_attributes:
metadata_attributes:TECHNICAL DETAILS
Some legitimate administration scripts or web applications running under IIS
may spawn command-line interpreters. However, this is generally rare for the
WSUS application pool.
Policy building walkthrough can be found in this previous post: