Hackers Can Abuse Microsoft WSUS Servers to Deploy Malicious Updates via NTLM Relay

Security researchers have shown how attackers could exploit Microsoft Windows Server Update Services (WSUS) infrastructure to distribute malicious software updates across enterprise networks.

This technique relies on NTLM authentication coercion and relay attacks targeting WSUS deployments that utilize a separate Microsoft SQL Server database.

WSUS is commonly used by organizations to centrally manage, approve, and distribute Microsoft updates to Windows endpoints. Given its trusted role in the software update process, compromising its backend infrastructure could give attackers a powerful means of lateral movement and persistent access.

Hackers Can Abuse Microsoft WSUS Servers

The Specterops research focuses on WSUS environments where the upstream WSUS server and the WSUS database are hosted on different systems. In this setup, the WSUS server communicates with the SUSDB database through SQL queries, using its machine account.

If an attacker can coerce the upstream WSUS server to authenticate with an attacker-controlled host, they can relay that NTLM authentication to the external SQL Server. If successful, the attacker gains a SQL session authenticated as the WSUS computer account.

However, there is a key limitation: the WSUS machine account does not always receive extensive database permissions. Instead, it may belong to the webService role in the SQL database, which lacks direct SELECT, UPDATE, and DELETE permissions for SUSDB tables.

Despite this, the role may retain permission to execute WSUS stored procedures, allowing manipulation of update metadata and deployment workflows.

The research indicates that attackers could chain legitimate WSUS stored procedures to import, configure, and deploy a custom update. This capability turns a restricted SQL session into a potential mechanism for distributing updates.

A central component is the `spImportUpdate` procedure, which imports update metadata into the WSUS database. This metadata can define an update identifier, title, publisher ID, file name, download size, hashes, installation behavior, and command-line installation details.

Additional procedures can save required XML fragments, including:

• UpdateIdentity: Defines deployment eligibility, relationships, and prerequisites.
• LocalizedProperties: Supplies titles, descriptions, support links, and other user-visible metadata.
• ExtendedProperties: Contains technical installation data, such as file hashes, payload size, reboot behavior, and command-execution instructions.

Attackers could craft a malicious package to resemble a routine security or critical update, increasing the likelihood that administrators or users overlook suspicious activity.

The attack chain can also support selective deployment instead of mass distribution. WSUS stored procedures enable the creation of computer target groups, the identification of registered client systems, and the assignment of specific devices to chosen groups.

During the final deployment process, an attacker could approve an update for a selected target group and set an installation deadline. This means the attacker would not necessarily need to push a payload to every endpoint; they could focus on high-value servers, administrator workstations, or systems used for lateral movement.

This technique raises significant concerns because WSUS clients are configured to trust their internal update server, typically through Group Policy or registry settings. Administrators can identify a configured WSUS endpoint by reviewing the WUServer and WUStatusServer policy values on Windows clients.

Defensive Measures

Organizations should examine whether WSUS is using a remotely hosted SQL Server and assess the privileges granted to WSUS machine accounts.

Implementing NTLM relay protections should be a priority, including enforcing SMB signing, enabling Extended Protection for Authentication where supported, limiting NTLM usage, and monitoring for unusual machine-account authentications.

Security teams should also monitor SUSDB activity for unexpected stored procedure executions, newly created update records, unusual target groups, altered approval rules, and external payload URLs.

Restricting network access to WSUS and database servers, along with separating administrative duties, can further minimize the impact of a compromise.

This research highlights a broader lesson: trusted enterprise management platforms can become highly effective attack delivery systems if their authentication paths and backend permissions are not meticulously secured.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world