WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedures — Threadlinqs Intelligence
As of 2026-08-10, WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedures is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 14 indicators of compromise.
Threat ID: TL-2026-1966 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
SpecterOps demonstrated an attack chain against split-host WSUS deployments: an attacker coerces the WSUS server's machine account to authenticate to a relay point, relays that NTLM authentication to
On 2026-08-05, SpecterOps researcher Beyviel David ("Bagel") published a two-part technical disclosure (tied to a Black Hat USA 2026 talk, "Turning Enterprise Update Servers Into Backdoor Factories") describing how a common WSUS architecture choice — hosting the SUSDB database on a SQL Server instance separate from the WSUS application server — creates a network-relay attack surface into the update-distribution pipeline itself.
The attack begins with authentication coercion: the researcher used PetitPotam to force the upstream WSUS server's machine account (e.g. WSUS1$) to initiate SMB authentication toward an attacker-controlled listener. Impacket's Ntlmrelayx then relays that captured NTLM authentication over the TDS protocol to the remote SQL Server hosting SUSDB, establishing a live SQL session as the WSUS computer account. That account is a member of the SUSDB `webService` database role, which — while lacking direct SELECT/UPDATE/DELETE rights — retains EXECUTE permission on a set of native stored procedures that were never designed to be reachable by an untrusted network relay.
From that session, the attacker chains `spImportUpdate` (creates the update record and returns a RevisionID), `spSaveXmlFragment` (writes UpdateIdentity, LocalizedProperties, and ExtendedProperties XML fragments — including FileName, FileDigest, InstallCommand, and RebootBehavior), `spSetBatchURL` (points the update's payload at an attacker-hosted file), `spCreateTargetGroup` and `spAddComputerToTargetGroup` (scope the malicious update to one or a handful of victim computers instead of the whole fleet), and finally `spDeployUpdate` (marks the update approved and assigned with an installation deadline). By embedding the built-in "Critical" update-category GUID (`E6CF1350-C01B-414D-A61F-263D14D133B4`) in the forged prerequisites, the update also qualifies for WSUS's Default Automatic Approval Rule, so it installs without any administrator clicking approve.
SpecterOps released NotWSUSpicious (Python 3.11+), which automates SQL generation for this chain — computing SHA-1/SHA-256/file-size metadata, emitting the stored-procedure calls, and driving them through a custom Impacket-based `mssqlclient.py` over a Ntlmrelayx-established SOCKS proxy (proxychains, port 1080). A companion tool, BitsWebServer.py, serves the payload to the victim over the BITS protocol (default port 8080) with HTTP range-request support to mimic legitimate Windows Update delivery. Independent reporting (cybersecuritynews.com, 2026-08-06) added that reverse-engineering of `Microsoft.UpdateServices.ContentSyncAgent.dll` uncovered a logic error in its digital-signature verification routine: files whose names end in `.txt` or `.esd` skip signature validation entirely, letting an unsigned, attacker-supplied executable (delivered as e.g. `payload.exe.txt`) execute on the endpoint via the normal BITS/Windows Update install path. The same reporting noted the forged update can be configured to automatically redeploy if the payload process is terminated, giving the technique a self-healing quality on the target.
SpecterOps also released ludus_wsus, an Ansible role for the Ludus lab framework that stands up a reproducer environment (a domain controller, a Windows Server 2019 WSUS host, a separate SQL Server 2022 SUSDB host, and Windows 11/Server 2016 clients under WSUS-managed GPO) so defenders can rebuild and instrument the exact vulnerable topology.
No CVE has been assigned to this stored-procedure/NTLM-relay chain as of publication, and none of the primary sources report confirmed in-the-wild exploitation — this is public offensive-security research with released PoC tooling, not an observed campaign. Separately, and not to be conflated with this technique, Microsoft's July 2026 Patch Tuesday shipped CVE-2026-50444, a distinct WSUS elevation-of-privilege vulnerability (CWE-306, missing authentication for a critical function, CVSS 8.8) affecting Windows Server 2012 through 2025; none
Weaknesses (CWE)
CWE-294, CWE-269, CWE-306
Target sectors: enterprise-it
Target regions: Global
Timeline
- TrustedSec publishes "WSUS Is SUS: NTLM Relay Attacks in Plain Sight," documenting WSUS HTTP/HTTPS traffic interception and machine-account NTLM relay to LDAP/SMB as a prior exposure class.
- Microsoft ships CVE-2026-50444 (WSUS elevation-of-privilege, missing authentication for a critical function, CVSS 8.8) in July 2026 Patch Tuesday — a distinct WSUS flaw, not the SUSDB stored-procedure chain covered here.
- SpecterOps publishes Part 1 of "Turning Enterprise Update Servers Into Backdoor Factories," detailing NTLM-relay coercion of the WSUS machine account into SUSDB and chaining of spImportUpdate through spDeployUpdate to forge a deployable update.
- SpecterOps releases ludus_wsus, an Ansible role reproducing a vulnerable split-host WSUS/SUSDB lab topology for the Ludus framework.
- SpecterOps publishes "Weaponizing Windows Updates with NotWSUSpicious" and researcher Beyviel David ("Bagel") releases the NotWSUSpicious automation tool on GitHub.
- cybersecuritynews.com reports reverse-engineering findings that Microsoft.UpdateServices.ContentSyncAgent.dll skips digital-signature validation for payload files named with .txt or .esd extensions, and that forged updates can auto-redeploy if killed.
- GBHackers publishes summary coverage of the SpecterOps research, amplifying the attack chain to a wider security-news audience.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 14 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1608.001, T1195.003, T1187, T1557.001, T1078.002, T1553.002, T1036, T1197
