WSUS Servers to Deliver Malware

Overview

New research from SpecterOps reveals how adversaries can hijack Windows Server Update Services (WSUS) to deliver malware disguised as trusted updates. By exploiting architectural flaws in WSUS deployments that rely on external SQL Server databases, attackers can mint malicious “updates” that domain‑joined endpoints automatically trust and execute.

Attack Chain Breakdown

Phase	Mechanism / Component	Impact
Authentication coercion	PetitPotam + Ntlmrelayx	Forces SMB authentication, relays WSUS computer account session to SUSDB
Database injection	Stored procedures (spImportUpdate, spSaveXmlFragment, spSetBatchURL, spCreateTargetGroup, spDeployUpdate)	Forges malicious update packages inside database tables
Signature bypass	Logic flaw in ContentSyncAgent.dll	Skips digital signature validation for .txt and .esd files
Payload execution	BITS protocol + Group Policy	Silently installs payloads with persistent auto‑redeployment

How the Exploit Works

• NTLM Relaying: Attackers coerce WSUS servers to authenticate over SMB, relaying credentials to the SQL backend.
• Stored Procedure Chaining: WSUS permissions allow execution of specific SQL procedures, enabling attackers to forge update metadata and deployment instructions.
• Signature Validation Flaw: Reverse‑engineering revealed that .txt and .esd files bypass signature checks. Malicious executables renamed as Ghost.txt can slip through undetected.
• BITS Deployment: Group Policy auto‑installs updates, ensuring malware executes silently and re‑deploys if terminated.

Why It Matters

WSUS is a trusted patch‑management system across enterprises. Compromising it means attackers can:

• Deliver malware as “official” updates.
• Establish persistent footholds across endpoints.
• Move laterally within Active Directory environments.
• Evade detection by exploiting trusted infrastructure.

Defensive Guidance

• Enable Extended Protection for Authentication: Blocks NTLM relaying to SUSDB.
• Segment networks: Restrict database access to authorized WSUS servers only.
• Audit stored procedure calls: Monitor for anomalous invocations of spCreateTargetGroup, spDeployUpdate, or .txt/.esd references.
• Monitor outbound traffic: Detect suspicious BITS downloads or unsigned payloads.
• Replace or patch vulnerable WSUS deployments: Use SpecterOps’ tools (ludus_wsus, NotWSUSpicious) to test and harden environments.

Expert in the Cloud Insight

This research highlights how trusted infrastructure can become the ultimate backdoor. By chaining authentication coercion, stored procedure abuse, and signature bypass, attackers weaponize WSUS against the very endpoints it is meant to protect. For defenders, the lesson is clear: patch management systems must be treated as high‑value assets, monitored rigorously, and isolated from untrusted network paths.