Analytics BIOC Informational
✕

Rare MS-Update Server was detected

The endpoint requested an MS-Update operation from a rare update server.

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall EAL Logs
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Trusted Relationship (T1199)
Attacker's goals:

The Windows Server Update Services enable machines to discover and download software updates from a dedicated update server. Attackers may use the MS-Update protocol to execute unauthorized code through Microsoft binaries.

Investigative actions:

Inspect the legitimacy of the server as a WSUS functioning server. Verify that your MS-Update network routine is HTTPS enforced* Verify that this MS-Update server is not a newly deployed server as part of a legitimate IT activity.

Test period:
N/A (single event)
Deduplication:
2 Days
1 variation:
  • Rare MS-Update Server was detected Informational