Skip to content

Commit 58bf9a1

Browse files
MHaggisnasbench
MHaggis
and
nasbench
authored
WSUSpect in Custody: CVE-2025-59287 (#3743)
* WSUSpect in Custody: CVE-2025-59287 * WSUS and Updates * :jt_stare: * Update windows_wsus_spawning_shell.yml * Update w3wp_spawning_shell.yml * deprecate rules and map analytic stories --------- Co-authored-by: Nasreddine Bencherchali <[email protected]>
1 parent 9fc8942 commit 58bf9a1

20 files changed

+200
-45
lines changed

detections/endpoint/linux_java_spawning_shell.yml renamed to detections/deprecated/linux_java_spawning_shell.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: Linux Java Spawning Shell
22
id: 7b09db8a-5c20-11ec-9945-acde48001122
3-
version: 9
4-
date: '2025-10-07'
3+
version: 10
4+
date: '2025-10-25'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
88
description: The following analytic detects instances where Java, or Tomcat
99
processes spawn a Linux shell, which may indicate exploitation attempts, such as

detections/endpoint/windows_java_spawning_shells.yml renamed to detections/deprecated/windows_java_spawning_shells.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: Windows Java Spawning Shells
22
id: 28c81306-5c47-11ec-bfea-acde48001122
3-
version: 11
4-
date: '2025-10-07'
3+
version: 12
4+
date: '2025-10-25'
55
author: Michael Haag, Splunk
6-
status: experimental
6+
status: deprecated
77
type: TTP
88
description: The following analytic identifies instances where java.exe or w3wp.exe
99
spawns a Windows shell, such as cmd.exe or powershell.exe. This detection leverages

‎detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco NVM - Curl Execution With Insecure Flags
22
id: cc695238-3117-4e60-aa83-4beac2a42c69
3-
version: 3
4-
date: '2025-09-10'
3+
version: 4
4+
date: '2025-10-24'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -85,6 +85,7 @@ tags:
8585
analytic_story:
8686
- Cisco Network Visibility Module Analytics
8787
- PromptLock
88+
- Microsoft WSUS CVE-2025-59287
8889
asset_type: Endpoint
8990
mitre_attack_id:
9091
- T1197

‎detections/endpoint/malicious_powershell_process___encoded_command.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Malicious PowerShell Process - Encoded Command
22
id: c4db14d9-7909-48b4-a054-aa14d89dbb19
3-
version: 17
4-
date: '2025-09-16'
3+
version: 18
4+
date: '2025-10-24'
55
author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community
66
status: production
77
type: Hunting
@@ -63,6 +63,7 @@ tags:
6363
- Microsoft SharePoint Vulnerabilities
6464
- Scattered Spider
6565
- GhostRedirector IIS Module and Rungan Backdoor
66+
- Microsoft WSUS CVE-2025-59287
6667
asset_type: Endpoint
6768
mitre_attack_id:
6869
- T1027

‎detections/endpoint/possible_lateral_movement_powershell_spawn.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Possible Lateral Movement PowerShell Spawn
22
id: cb909b3e-512b-11ec-aa31-3e22fbd008af
33
version: 12
4-
date: '2025-10-21'
4+
date: '2025-10-24'
55
author: Mauricio Velazco, Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -78,6 +78,7 @@ tags:
7878
- Data Destruction
7979
- Scheduled Tasks
8080
- CISA AA24-241A
81+
- Microsoft WSUS CVE-2025-59287
8182
asset_type: Endpoint
8283
mitre_attack_id:
8384
- T1021.003

‎detections/endpoint/powershell_4104_hunting.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: PowerShell 4104 Hunting
22
id: d6f2b006-0041-11ec-8885-acde48001122
33
version: 21
4-
date: '2025-10-14'
4+
date: '2025-10-24'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -86,6 +86,7 @@ tags:
8686
- APT37 Rustonotto and FadeStealer
8787
- GhostRedirector IIS Module and Rungan Backdoor
8888
- Hellcat Ransomware
89+
- Microsoft WSUS CVE-2025-59287
8990
asset_type: Endpoint
9091
mitre_attack_id:
9192
- T1059.001

‎detections/endpoint/powershell_domain_enumeration.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: PowerShell Domain Enumeration
22
id: e1866ce2-ca22-11eb-8e44-acde48001122
3-
version: 10
4-
date: '2025-07-28'
3+
version: 11
4+
date: '2025-10-24'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -65,6 +65,7 @@ tags:
6565
- CISA AA23-347A
6666
- Data Destruction
6767
- Interlock Ransomware
68+
- Microsoft WSUS CVE-2025-59287
6869
asset_type: Endpoint
6970
mitre_attack_id:
7071
- T1059.001

‎detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Powershell Fileless Script Contains Base64 Encoded Content
22
id: 8acbc04c-c882-11eb-b060-acde48001122
33
version: 14
4-
date: '2025-10-14'
4+
date: '2025-10-24'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -67,6 +67,7 @@ tags:
6767
- APT37 Rustonotto and FadeStealer
6868
- GhostRedirector IIS Module and Rungan Backdoor
6969
- Hellcat Ransomware
70+
- Microsoft WSUS CVE-2025-59287
7071
mitre_attack_id:
7172
- T1027
7273
- T1059.001

‎detections/endpoint/web_or_application_server_spawning_a_shell.yml‎

Lines changed: 30 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ data_source:
1818
- Sysmon for Linux EventID 1
1919
- Sysmon EventID 1
2020
search: |
21-
| tstats `security_content_summariesonly`
22-
count min(_time) as firstTime
23-
max(_time) as lastTime
24-
25-
from datamodel=Endpoint.Processes where
26-
21+
| tstats `security_content_summariesonly`
22+
count min(_time) as firstTime
23+
max(_time) as lastTime
24+
25+
from datamodel=Endpoint.Processes where
26+
2727
(
2828
Processes.parent_process_name IN ("java", "tomcat*", "httpd", "lighttpd", "apache2", "nginx", "node", "caddy")
2929
`linux_shells`
@@ -33,15 +33,15 @@ search: |
3333
Processes.parent_process_name IN ("httpd.exe", "nginx.exe", "php*.exe", "php-cgi.exe", "tomcat*.exe", "caddy.exe", "UMWorkerProcess.exe", "w3wp.exe", "ws_TomcatService.exe", "node.exe", "java.exe")
3434
`windows_shells`
3535
)
36-
36+
3737
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
3838
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
3939
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
40-
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
40+
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
4141
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
42-
43-
| `drop_dm_object_name(Processes)`
44-
| `security_content_ctime(firstTime)`
42+
43+
| `drop_dm_object_name(Processes)`
44+
| `security_content_ctime(firstTime)`
4545
| `security_content_ctime(lastTime)`
4646
| `web_or_application_server_spawning_a_shell_filter`
4747
how_to_implement: |
@@ -87,10 +87,25 @@ rba:
8787
type: process_name
8888
tags:
8989
analytic_story:
90-
- Data Destruction
91-
- Spring4Shell CVE-2022-22965
92-
- Hermetic Wiper
93-
- Log4Shell CVE-2021-44228
90+
- BlackByte Ransomware
91+
- CISA AA22-257A
92+
- CISA AA22-264A
93+
- Cleo File Transfer Software
94+
- Data Destruction
95+
- Flax Typhoon
96+
- GhostRedirector IIS Module and Rungan Backdoor
97+
- HAFNIUM Group
98+
- Hermetic Wiper
99+
- Log4Shell CVE-2021-44228
100+
- Microsoft SharePoint Vulnerabilities
101+
- Microsoft WSUS CVE-2025-59287
102+
- PHP-CGI RCE Attack on Japanese Organizations
103+
- ProxyNotShell
104+
- ProxyShell
105+
- SAP NetWeaver Exploitation
106+
- Spring4Shell CVE-2022-22965
107+
- SysAid On-Prem Software CVE-2023-47246 Vulnerability
108+
- WS FTP Server Critical Vulnerabilities
94109
asset_type: Endpoint
95110
mitre_attack_id:
96111
- T1190

‎detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Common Abused Cmd Shell Risk Behavior
22
id: e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a
3-
version: 6
4-
date: '2025-05-02'
3+
version: 7
4+
date: '2025-10-24'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Correlation
@@ -69,6 +69,7 @@ tags:
6969
- Windows Defense Evasion Tactics
7070
- CISA AA23-347A
7171
- Disabling Security Tools
72+
- Microsoft WSUS CVE-2025-59287
7273
asset_type: Endpoint
7374
mitre_attack_id:
7475
- T1222

0 commit comments

Comments
 (0)