A novel attack chain enables adversaries to compromise Windows Server Update Services (WSUS), a trusted patch-management system widely used in enterprise environments This article explores services wsus trusted. . SpecterOps researcher Beyviel David's research reveals that organizations using an external SQL Server database for WSUS on their network face significant operational risks: attackers with local network access can exploit authentication vulnerabilities, gain database session control, and create malicious updates that domain-joined endpoints trust and execute automatically.
Enterprise WSUS Deployments Often Separate Update Management Server from Storage Enterprise deployments of WSUS frequently separate the update management server from its backend storage, using a standalone Microsoft SQL Server instance rather than relying on the default Windows Internal Database. Monitoring these relay vectors is crucial for maintaining Active Directory security across corporate networks.
Upon obtaining initial access via NTLM relaying, the attacker secures themselves in the restricted webService role, which lacks direct SELECT, UPDATE, or DELETE permissions on core tables. By chaining native SQL stored procedures such as spImportUpdate, spSaveXmlFragment, spSetBatchURL, spCreateTargetGroup, and spDeployUpdate, an attacker can fabricate a comprehensive Windows update package that includes arbitrary metadata, file hashes, and execution instructions. Stored procedure EXECUTE permissions (Source: Specterops.io) SpecterOps researchers reverse-engineered Microsoft's UpdateServices.ContentSyncAgent.dll library using dnSpy, uncovering a logic flaw in the file-verification routine: File Extension Check: The verification process examines whether a payload filename ends with .txt or .esd.
