@[email protected]

“So WSUS with HTTPS is secure, you said? 😂” Turns out… not really. According to the excellent research by Alexander Neff and Phil Knüfer in “Using ADCS to Attack HTTPS‑Enabled WSUS Clients,” a misconfigured ADCS environment can completely undermine HTTPS‑protected WSUS. They demonstrate how overly permissive certificate templates—especially those allowing user‑defined subject names and limited to the Server Authentication EKU—let an attacker obtain a trusted certificate and impersonate a WSUS server. Combine that with classic WSUS interception techniques, and suddenly you can push malicious updates that run with full admin privileges on Windows clients, all while the traffic looks perfectly valid and encrypted. From a defender’s point of view, the big question becomes: How do you detect if your WSUS clients have been talking to a hijacked WSUS server? 😅 Good news: it is detectable—and here’s the KQL to help you spot it. #Cyberesecurity #WSUSHiJackAttack