# WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedures

> SpecterOps demonstrated an attack chain against split-host WSUS deployments: an attacker coerces the WSUS server's machine account to authenticate to a relay point, relays that NTLM authentication to the SQL Server hosting SUSDB, then chains native stored procedures (spImportUpdate through spDeployUpdate) to forge and covertly push a malicious Windows update to a chosen target group. Public tooling (NotWSUSpicious, ludus_wsus) implements the chain; no CVE has been assigned and no in-the-wild exploitation has been confirmed.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1966
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-wsus-ntlm-relay-updates-tl-2026-1966.webp?v=2dae5356 (Threadlinqs threat intel: WSUS NTLM Relay Malicious Updates: Detection & IOCs (TL-2026-1966) — High severity, 14 IOCs, 9 detection rules.)
- **ID:** TL-2026-1966
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 14

## Description

On 2026-08-05, SpecterOps researcher Beyviel David ("Bagel") published a two-part technical disclosure (tied to a Black Hat USA 2026 talk, "Turning Enterprise Update Servers Into Backdoor Factories") describing how a common WSUS architecture choice — hosting the SUSDB database on a SQL Server instance separate from the WSUS application server — creates a network-relay attack surface into the update-distribution pipeline itself.

The attack begins with authentication coercion: the researcher used PetitPotam to force the upstream WSUS server's machine account (e.g. WSUS1$) to initiate SMB authentication toward an attacker-controlled listener. Impacket's Ntlmrelayx then relays that captured NTLM authentication over the TDS protocol to the remote SQL Server hosting SUSDB, establishing a live SQL session as the WSUS computer account. That account is a member of the SUSDB `webService` database role, which — while lacking direct SELECT/UPDATE/DELETE rights — retains EXECUTE permission on a set of native stored procedures that were never designed to be reachable by an untrusted network relay.

From that session, the attacker chains `spImportUpdate` (creates the update record and returns a RevisionID), `spSaveXmlFragment` (writes UpdateIdentity, LocalizedProperties, and ExtendedProperties XML fragments — including FileName, FileDigest, InstallCommand, and RebootBehavior), `spSetBatchURL` (points the update's payload at an attacker-hosted file), `spCreateTargetGroup` and `spAddComputerToTargetGroup` (scope the malicious update to one or a handful of victim computers instead of the whole fleet), and finally `spDeployUpdate` (marks the update approved and assigned with an installation deadline). By embedding the built-in "Critical" update-category GUID (`E6CF1350-C01B-414D-A61F-263D14D133B4`) in the forged prerequisites, the update also qualifies for WSUS's Default Automatic Approval Rule, so it installs without any administrator clicking approve.

SpecterOps released NotWSUSpicious (Python 3.11+), which automates SQL generation for this chain — computing SHA-1/SHA-256/file-size metadata, emitting the stored-procedure calls, and driving them through a custom Impacket-based `mssqlclient.py` over a Ntlmrelayx-established SOCKS proxy (proxychains, port 1080). A companion tool, BitsWebServer.py, serves the payload to the victim over the BITS protocol (default port 8080) with HTTP range-request support to mimic legitimate Windows Update delivery. Independent reporting (cybersecuritynews.com, 2026-08-06) added that reverse-engineering of `Microsoft.UpdateServices.ContentSyncAgent.dll` uncovered a logic error in its digital-signature verification routine: files whose names end in `.txt` or `.esd` skip signature validation entirely, letting an unsigned, attacker-supplied executable (delivered as e.g. `payload.exe.txt`) execute on the endpoint via the normal BITS/Windows Update install path. The same reporting noted the forged update can be configured to automatically redeploy if the payload process is terminated, giving the technique a self-healing quality on the target.

SpecterOps also released ludus_wsus, an Ansible role for the Ludus lab framework that stands up a reproducer environment (a domain controller, a Windows Server 2019 WSUS host, a separate SQL Server 2022 SUSDB host, and Windows 11/Server 2016 clients under WSUS-managed GPO) so defenders can rebuild and instrument the exact vulnerable topology.

No CVE has been assigned to this stored-procedure/NTLM-relay chain as of publication, and none of the primary sources report confirmed in-the-wild exploitation — this is public offensive-security research with released PoC tooling, not an observed campaign. Separately, and not to be conflated with this technique, Microsoft's July 2026 Patch Tuesday shipped CVE-2026-50444, a distinct WSUS elevation-of-privilege vulnerability (CWE-306, missing authentication for a critical function, CVSS 8.8) affecting Windows Server 2012 through 2025; none of the SpecterOps or follow-on reporting on this specific chain references that CVE as the underlying fix, so it is documented here only as contemporaneous WSUS-hardening context, not as the CVE for this attack chain.

Core mitigations converge on removing the relay path and the excess trust: enforce SMB signing and Extended Protection for Authentication (EPA) on the SQL Server hosting SUSDB, restrict network reachability to that SQL instance to the WSUS server only, and prefer co-locating WSUS with its database (or using the Windows Internal Database) so no NTLM-relayable network hop exists between them.

## MITRE ATT&CK

- T1608.001 Upload Malware
- T1195.003 Compromise Hardware Supply Chain
- T1187 Forced Authentication
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1078.002 Domain Accounts
- T1553.002 Code Signing
- T1036 Masquerading
- T1197 BITS Jobs

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BITS-Delivered Masqueraded WSUS Update Payload (.exe.txt / .esd Signature Bypass) — C2/Lateral Movement Phase** (`TL-2026-1966-SPL-003`)

Detects a BITS job on an endpoint transferring a payload whose URL uses port 8080 (the NotWSUSpicious BitsWebServer.py default) and/or a filename masqueraded with a .exe.txt or .esd extension — the documented Microsoft.UpdateServices.ContentSyncAgent.dll signature-check bypass that lets an unsigned executable install through the normal Windows Update/BITS delivery path. This is the endpoint-side content-delivery/execution stage of the forged WSUS update, and the vector by which the malicious update propagates and can self-redeploy.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1197, T1036, T1553.002, T1072
- **Data sources:** bits_client_operational_eventlog, sysmon_process_creation, windows_update_agent_log
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:Microsoft-Windows-Bits-Client/Operational" EventCode IN (3,4,59,60)
| rex field=Message "(?i)(URL|Url)[:=]\s*(?<bits_url>\S+)"
| where match(bits_url, "(?i)\.exe\.txt(\?|$)") OR match(bits_url, "(?i)\.esd(\?|$)") OR match(bits_url, ":8080/")
| stats count min(_time) as first_seen max(_time) as last_seen values(bits_url) as urls by host User
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort == 8080
| where RemoteUrl endswith ".exe.txt" or RemoteUrl endswith ".esd"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where FileName has_any ("wuauclt.exe", "usoclient.exe", "svchost.exe")
) on DeviceName
| project TimeGenerated, DeviceName, RemoteUrl, InitiatingProcessFileName, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: BITS Download of Masqueraded WSUS Update Payload (.exe.txt / .esd Signature-Check Bypass)
id: 9d8e7f6a-5b4c-4d3e-8f2a-1b0c9d8e7f6a
status: experimental
description: Detects a BITS transfer of a file masqueraded with a .exe.txt or .esd extension, or delivered over the NotWSUSpicious BitsWebServer.py default port 8080, exploiting the Microsoft.UpdateServices.ContentSyncAgent.dll digital-signature verification bypass so an unsigned executable installs via the legitimate WSUS/BITS update path.
references:
  - https://cybersecuritynews.com/wsus-servers-leveraged-to-deliver-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/10
tags:
  - attack.defense-evasion
  - attack.command-and-control
  - attack.t1197
  - attack.t1036
  - attack.t1553.002
  - attack.t1072
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID:
      - 3
      - 59
      - 60
  selection_indicator:
    Url|contains: ':8080/'
  selection_ext:
    Url|re: '(?i)\.exe\.txt($|[\?])|\.esd($|[\?])'
  condition: selection and (selection_indicator or selection_ext)
falsepositives:
  - Internal applications legitimately using port 8080 for BITS-based content delivery (e.g. a proxy or internal WDS system)
  - Legitimate .esd Windows Enablement Package downloads during OS upgrade servicing
level: high
```

**Known false positives:**

- Internal applications legitimately using port 8080 for BITS-based content delivery (e.g. a proxy or internal WDS system)
- Legitimate .esd Windows Enablement Package downloads during OS upgrade servicing

**Tuning notes:** Maintain an allowlist of approved internal BITS/WSUS content-source URLs and ports; raise confidence to critical when the same masqueraded-extension file is subsequently written to disk and executed (correlate with process creation of the same file hash within the following minutes).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- WSUS Machine Account NTLM Relay to SUSDB SQL Server — Exploitation Phase (locked: unlock with TL Creds)
- SUSDB Stored Procedure Chain Abuse (spImportUpdate → spDeployUpdate) — Post-Exploitation Phase (locked: unlock with TL Creds)
- BITS-Delivered Masqueraded WSUS Update Payload (.exe.txt / .esd Signature Bypass) — C2/Lateral Movement Phase (locked: unlock with TL Creds)
- WSUS Machine Account NTLM Relay to SUSDB SQL Server — Exploitation Phase (locked: unlock with TL Creds)
- SUSDB Stored Procedure Chain Abuse (spImportUpdate → spDeployUpdate) — Post-Exploitation Phase (locked: unlock with TL Creds)
- BITS-Delivered Masqueraded WSUS Update Payload (.exe.txt / .esd Signature Bypass) — C2/Lateral Movement Phase (locked: unlock with TL Creds)
- WSUS Machine Account NTLM Relay to SUSDB SQL Server — Exploitation Phase (locked: unlock with TL Creds)
- SUSDB Stored Procedure Chain Abuse (spImportUpdate → spDeployUpdate) — Post-Exploitation Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Hackers Can Abuse Microsoft WSUS Servers to Deploy Malicious Updates via NTLM Relay](https://gbhackers.com/hackers-can-abuse-microsoft-wsus-servers/)
- [Turning Enterprise Update Servers Into Backdoor Factories (0_o) - Part 1](https://specterops.io/blog/2026/08/05/turning-enterprise-update-servers-into-backdoor-factories-part-1/)
- [Weaponizing Windows Updates with NotWSUSpicious](https://specterops.io/blog/2026/08/05/weaponizing-windows-updates-with-notwsuspicious/)
- [Of Course We Built a WSUS Ludus Lab](https://specterops.io/blog/2026/08/05/built-a-wsus-ludus-lab/)
- [Hackers Can Leverage WSUS Servers to Deliver Malware and Compromise Enterprise Endpoints](https://cybersecuritynews.com/wsus-servers-leveraged-to-deliver-malware/)
- [NotWSUSpicious (GitHub repository)](https://github.com/bagelByt3s/NotWSUSpicious)
- [ludus_wsus (GitHub repository)](https://github.com/bagelByt3s/ludus_wsus)
- [WSUS Is SUS: NTLM Relay Attacks in Plain Sight](https://trustedsec.com/blog/wsus-is-sus-ntlm-relay-attacks-in-plain-sight)
- [CVE-2026-50444 - Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50444)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1966