Skip to content
Threat Feed
Subscribe

Product

Windows Server Update Services

2 briefs RSS
medium advisory

Potential WSUS Abuse for Lateral Movement via PsExec

Adversaries may exploit Windows Server Update Services (WSUS) to execute PsExec for lateral movement within a network by abusing the trusted update mechanism to run signed binaries.

Windows Server Update Services lateral-movement wsus psexec windows
2r 2t
medium advisory

Potential WSUS Abuse for Lateral Movement via PsExec

This rule detects potential abuse of Windows Server Update Services (WSUS) for lateral movement by identifying suspicious processes, specifically PsExec, initiated by WSUS (wuauclt.exe).

Windows Server Update Services lateral-movement windows wsus psexec
2r 2t