WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedures

Key facts for WSUS NTLM relay updates

Detection coverage for WSUS NTLM relay updates

As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1966 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BITS-Delivered Masqueraded WSUS Update Payload (.exe.txt / .esd Signature Bypass) — C2/Lateral Movement Phase

Detects a BITS job on an endpoint transferring a payload whose URL uses port 8080 (the NotWSUSpicious BitsWebServer.py default) and/or a filename masqueraded with a .exe.txt or .esd extension — the documented Microsoft.UpdateServices.ContentSyncAgent.dll signature-check bypass that lets an unsigned executable install through the normal Windows Update/BITS delivery path. This is the endpoint-side content-delivery/execution stage of the forged WSUS update, and the vector by which the malicious update propagates and can self-redeploy.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1197, T1036, T1553.002, T1072
• Data sources: bits_client_operational_eventlog, sysmon_process_creation, windows_update_agent_log
• Severity: critical
• Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Microsoft-Windows-Bits-Client/Operational" EventCode IN (3,4,59,60)
| rex field=Message "(?i)(URL|Url)[:=]\s*(?<bits_url>\S+)"
| where match(bits_url, "(?i)\.exe\.txt(\?|$)") OR match(bits_url, "(?i)\.esd(\?|$)") OR match(bits_url, ":8080/")
| stats count min(_time) as first_seen max(_time) as last_seen values(bits_url) as urls by host User

Microsoft KQL

DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort == 8080
| where RemoteUrl endswith ".exe.txt" or RemoteUrl endswith ".esd"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where FileName has_any ("wuauclt.exe", "usoclient.exe", "svchost.exe")
) on DeviceName
| project TimeGenerated, DeviceName, RemoteUrl, InitiatingProcessFileName, FileName, ProcessCommandLine

Sigma

title: BITS Download of Masqueraded WSUS Update Payload (.exe.txt / .esd Signature-Check Bypass)
id: 9d8e7f6a-5b4c-4d3e-8f2a-1b0c9d8e7f6a
status: experimental
description: Detects a BITS transfer of a file masqueraded with a .exe.txt or .esd extension, or delivered over the NotWSUSpicious BitsWebServer.py default port 8080, exploiting the Microsoft.UpdateServices.ContentSyncAgent.dll digital-signature verification bypass so an unsigned executable installs via the legitimate WSUS/BITS update path.
references:
  - https://cybersecuritynews.com/wsus-servers-leveraged-to-deliver-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/10
tags:
  - attack.defense-evasion
  - attack.command-and-control
  - attack.t1197
  - attack.t1036
  - attack.t1553.002
  - attack.t1072
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID:
      - 3
      - 59
      - 60
  selection_indicator:
    Url|contains: ':8080/'
  selection_ext:
    Url|re: '(?i)\.exe\.txt($|[\?])|\.esd($|[\?])'
  condition: selection and (selection_indicator or selection_ext)
falsepositives:
  - Internal applications legitimately using port 8080 for BITS-based content delivery (e.g. a proxy or internal WDS system)
  - Legitimate .esd Windows Enablement Package downloads during OS upgrade servicing
level: high

Known false positives:

• Internal applications legitimately using port 8080 for BITS-based content delivery (e.g. a proxy or internal WDS system)
• Legitimate .esd Windows Enablement Package downloads during OS upgrade servicing

Tuning notes: Maintain an allowlist of approved internal BITS/WSUS content-source URLs and ports; raise confidence to critical when the same masqueraded-extension file is subsequently written to disk and executed (correlate with process creation of the same file hash within the following minutes).

• 🔒 WSUS Machine Account NTLM Relay to SUSDB SQL Server — Exploitation Phase · unlock with TL Creds
• 🔒 SUSDB Stored Procedure Chain Abuse (spImportUpdate → spDeployUpdate) — Post-Exploitation Phase · unlock with TL Creds
• 🔒 BITS-Delivered Masqueraded WSUS Update Payload (.exe.txt / .esd Signature Bypass) — C2/Lateral Movement Phase · unlock with TL Creds
• 🔒 WSUS Machine Account NTLM Relay to SUSDB SQL Server — Exploitation Phase · unlock with TL Creds
• 🔒 SUSDB Stored Procedure Chain Abuse (spImportUpdate → spDeployUpdate) — Post-Exploitation Phase · unlock with TL Creds
• 🔒 BITS-Delivered Masqueraded WSUS Update Payload (.exe.txt / .esd Signature Bypass) — C2/Lateral Movement Phase · unlock with TL Creds
• 🔒 WSUS Machine Account NTLM Relay to SUSDB SQL Server — Exploitation Phase · unlock with TL Creds
• 🔒 SUSDB Stored Procedure Chain Abuse (spImportUpdate → spDeployUpdate) — Post-Exploitation Phase · unlock with TL Creds

Indicators of compromise for WSUS NTLM relay updates

As of 2026-08-10, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-1966.

How WSUS NTLM relay updates works

Public tooling (NotWSUSpicious, ludus_wsus) implements the chain; no CVE has been assigned and no in-the-wild exploitation has been confirmed.

On 2026-08-05, SpecterOps researcher Beyviel David ("Bagel") published a two-part technical disclosure (tied to a Black Hat USA 2026 talk, "Turning Enterprise Update Servers Into Backdoor Factories") describing how a common WSUS architecture choice — hosting the SUSDB database on a SQL Server instance separate from the WSUS application server — creates a network-relay attack surface into the update-distribution pipeline itself.

The attack begins with authentication coercion: the researcher used PetitPotam to force the upstream WSUS server's machine account (e.g. WSUS1$) to initiate SMB authentication toward an attacker-controlled listener. Impacket's Ntlmrelayx then relays that captured NTLM authentication over the TDS protocol to the remote SQL Server hosting SUSDB, establishing a live SQL session as the WSUS computer account. That account is a member of the SUSDB `webService` database role, which — while lacking direct SELECT/UPDATE/DELETE rights — retains EXECUTE permission on a set of native stored procedures that were never designed to be reachable by an untrusted network relay.

From that session, the attacker chains `spImportUpdate` (creates the update record and returns a RevisionID), `spSaveXmlFragment` (writes UpdateIdentity, LocalizedProperties, and ExtendedProperties XML fragments — including FileName, FileDigest, InstallCommand, and RebootBehavior), `spSetBatchURL` (points the update's payload at an attacker-hosted file), `spCreateTargetGroup` and `spAddComputerToTargetGroup` (scope the malicious update to one or a handful of victim computers instead of the whole fleet), and finally `spDeployUpdate` (marks the update approved and assigned with an installation deadline). By embedding the built-in "Critical" update-category GUID (`E6CF1350-C01B-414D-A61F-263D14D133B4`) in the forged prerequisites, the update also qualifies for WSUS's Default Automatic Approval Rule, so it installs without any administrator clicking approve.

SpecterOps released NotWSUSpicious (Python 3.11+), which automates SQL generation for this chain — computing SHA-1/SHA-256/file-size metadata, emitting the stored-procedure calls, and driving them through a custom Impacket-based `mssqlclient.py` over a Ntlmrelayx-established SOCKS proxy (proxychains, port 1080). A companion tool, BitsWebServer.py, serves the payload to the victim over the BITS protocol (default port 8080) with HTTP range-request support to mimic legitimate Windows Update delivery. Independent reporting (cybersecuritynews.com, 2026-08-06) added that reverse-engineering of `Microsoft.UpdateServices.ContentSyncAgent.dll` uncovered a logic error in its digital-signature verification routine: files whose names end in `.txt` or `.esd` skip signature validation entirely, letting an unsigned, attacker-supplied executable (delivered as e.g. `payload.exe.txt`) execute on the endpoint via the normal BITS/Windows Update install path. The same reporting noted the forged update can be configured to automatically redeploy if the payload process is terminated, giving the technique a self-healing quality on the target.

SpecterOps also released ludus_wsus, an Ansible role for the Ludus lab framework that stands up a reproducer environment (a domain controller, a Windows Server 2019 WSUS host, a separate SQL Server 2022 SUSDB host, and Windows 11/Server 2016 clients under WSUS-managed GPO) so defenders can rebuild and instrument the exact vulnerable topology.

No CVE has been assigned to this stored-procedure/NTLM-relay chain as of publication, and none of the primary sources report confirmed in-the-wild exploitation — this is public offensive-security research with released PoC tooling, not an observed campaign. Separately, and not to be conflated with this technique, Microsoft's July 2026 Patch Tuesday shipped CVE-2026-50444, a distinct WSUS elevation-of-privilege vulnerability (CWE-306, missing authentication for a critical function, CVSS 8.8) affecting Windows Server 2012 through 2025; none of the SpecterOps or follow-on reporting on this specific chain references that CVE as the underlying fix, so it is documented here only as contemporaneous WSUS-hardening context, not as the CVE for this attack chain.

Core mitigations converge on removing the relay path and the excess trust: enforce SMB signing and Extended Protection for Authentication (EPA) on the SQL Server hosting SUSDB, restrict network reachability to that SQL instance to the WSUS server only, and prefer co-locating WSUS with its database (or using the Windows Internal Database) so no NTLM-relayable network hop exists between them.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1197 BITS Jobs

Privilege Escalation

T1078.002 Domain Accounts

Credential Access

T1187 Forced Authentication; T1557.001 Name Resolution Poisoning and SMB Relay

Initial Access

T1195.003 Compromise Hardware Supply Chain

defense-impairment

T1553.002 Code Signing

Resource Development

T1608.001 Upload Malware

Remediation for WSUS NTLM relay updates

Immediate actions

• Enable Extended Protection for Authentication (EPA) on the SQL Server instance hosting SUSDB to block relayed NTLM authentication
• Enforce SMB signing on the WSUS server, the SUSDB SQL Server, and any hosts reachable by the WSUS computer account
• Restrict network access to the SUSDB SQL Server so only the WSUS application server (and authorized DBAs) can connect to it
• Audit SUSDB for anomalous stored-procedure activity from the WSUS computer account, especially spImportUpdate, spCreateTargetGroup, spAddComputerToTargetGroup, and spDeployUpdate calls outside normal sync windows
• Review and tighten the SUSDB webService database role's EXECUTE grants where the deployment does not require the full stored-procedure surface

Workarounds

• Periodically audit WSUS target groups for unexpected or newly created groups and their computer membership
• Monitor the registry values WUServer/WUStatusServer under HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate on clients for unauthorized changes to the configured update source
• Alert on files delivered via BITS/WSUS whose names end in .txt or .esd but are executed as code, given the documented ContentSyncAgent.dll signature-check bypass for those extensions

Longer-term hardening

• Co-locate the WSUS application role and its database (or use the Windows Internal Database) so no network-relayable authentication hop exists between them
• Disable or replace the Default Automatic Approval Rule for Critical/Security categories with mandatory manual review
• Migrate update management to a cloud-managed service (e.g. Windows Autopatch) where on-premises WSUS/SUSDB is not operationally required
• Transition WSUS/SQL authentication from NTLM to Kerberos-only where supported, and disable NTLM at the domain level where feasible

Affected and fixed versions

• Microsoft — Windows Server Update Services (WSUS) with SUSDB on a separate SQL Server host
  Vulnerable versions: Any WSUS deployment where SUSDB is hosted on a SQL Server instance separate from the WSUS application server (WSUS on Windows Server 2016 and newer per the released lab; not applicable to single-host/WID deployments)
  Fixed in: No vendor patch published as of 2026-08-07; requires configuration mitigation (EPA, SMB signing, network restriction) rather than a code fix
• Microsoft — Windows Update Agent / BITS content delivery (Microsoft.UpdateServices.ContentSyncAgent.dll signature verification)
  Vulnerable versions: Signature-verification logic that skips digital-signature validation for payload filenames ending in .txt or .esd, per reverse-engineering reported 2026-08-06
  Fixed in: No vendor patch published as of the source reporting

Timeline of WSUS NTLM relay updates

• 2025-09-12 TrustedSec publishes "WSUS Is SUS: NTLM Relay Attacks in Plain Sight," documenting WSUS HTTP/HTTPS traffic interception and machine-account NTLM relay to LDAP/SMB as a prior exposure class.
• 2026-07-14 Microsoft ships CVE-2026-50444 (WSUS elevation-of-privilege, missing authentication for a critical function, CVSS 8.8) in July 2026 Patch Tuesday — a distinct WSUS flaw, not the SUSDB stored-procedure chain covered here.
• 2026-08-05 SpecterOps publishes "Weaponizing Windows Updates with locked-ioc-9" and researcher Beyviel David ("Bagel") releases the locked-ioc-9 automation tool on GitHub.
• 2026-08-05 SpecterOps releases locked-ioc-10, an Ansible role reproducing a vulnerable split-host WSUS/SUSDB lab topology for the Ludus framework.
• 2026-08-05 SpecterOps publishes Part 1 of "Turning Enterprise Update Servers Into Backdoor Factories," detailing NTLM-relay coercion of the WSUS machine account into SUSDB and chaining of spImportUpdate through spDeployUpdate to forge a deployable update.
• 2026-08-06 cybersecuritynews.com reports reverse-engineering findings that locked-ioc-3 skips digital-signature validation for payload files named with .txt or .esd extensions, and that forged updates can auto-redeploy if killed.
• 2026-08-07 GBHackers publishes summary coverage of the SpecterOps research, amplifying the attack chain to a wider security-news audience.

Sources cited for WSUS NTLM relay updates

• CVE-2026-50444 - Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability Microsoft Security Response Center · Advisory · 2026-07-14
• Turning Enterprise Update Servers Into Backdoor Factories (0_o) - Part 1 specterops.io · Research · 2026-08-05
• Weaponizing Windows Updates with NotWSUSpicious specterops.io · Research · 2026-08-05
• Of Course We Built a WSUS Ludus Lab specterops.io · Research · 2026-08-05
• NotWSUSpicious (GitHub repository) GitHub · Code repository · 2026-08-05
• ludus_wsus (GitHub repository) GitHub · Code repository · 2026-08-05
• WSUS Is SUS: NTLM Relay Attacks in Plain Sight trustedsec.com · Blog · 2025-09-12
• Hackers Can Abuse Microsoft WSUS Servers to Deploy Malicious Updates via NTLM Relay gbhackers.com · News · 2026-08-07
• Hackers Can Leverage WSUS Servers to Deliver Malware and Compromise Enterprise Endpoints cybersecuritynews.com · News · 2026-08-06

More in supply chain

• Backdoored ARTEX Docker Hub images (tomicdd/artex and clones) expose 62 consoles to unauthenticated root shell; CERT-In CIAD-2026-0058 flags AI-assisted actor Crafty Falcon
• PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)
• NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware
• Malicious cPGuard Updates Served in OpsShield Supply Chain Attack (Update CDN Compromise, cPGuard 5.88.12-5.88.19)
• Supply Chain Attack Artifacts in GitHub Repositories and Developer Machines (Miasma, Shai-Hulud, ForceMemo, Megalodon, GhostAction, TeamPCP and others)

Previous and next in supply chain

• Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper") Previous report
• WordPress Supply Chain Attack via BdThemes Promotional API Feed Poisoning (Element Pack, Prime Slider, and 5 More Plugins) Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages