WSUS Dangerous Misconfigurations

critical

Language:

Description

Windows Server Update Services (WSUS) is the Microsoft product that deploys Windows updates to workstations and servers. Misconfigurations of WSUS settings can lead to an elevation to administrator privileges from a standard account.

Solution

Certain Microsoft WSUS parameters can have a significant security impact on the entire Active Directory and therefore require careful configuration.

Indicator Details

Name: WSUS Dangerous Misconfigurations

Codename: C-WSUS-HARDENING

Severity: Critical

MITRE ATT&CK Information:

Tactic: TA0006 - Credential Access
- Techniques: T1557 - Adversary-in-the-Middle
Tactic: TA0008 - Lateral Movement
- Techniques: T1072 - Software Deployment Tools

Attacker Known Tools

Paul Stone, Alex Chapman: WSUSpect Proxy

Romain Coltel, Yves Le Provost: WSUSpendu

Detections

Analytics