WSUS Client Configuration Enumeration

Adversaries may manipulate a software update or distribution mechanism before clients receive the update. In a WSUS environment, a local-network adversary may target unauthenticated HTTP metadata; Microsoft warns that improperly protected WSUS connections can permit update-information tampering. Clients still verify update payload signatures and hashes, so an HTTP connection alone does not mean arbitrary altered content will install. The documented wsuks tool demonstrates a WSUS man-in-the-middle path and reports adding a user to local Administrators; its README does not support the prior claim of SYSTEM execution. ARP cache poisoning is a separate enabling behavior (T1557.002), while T1072 covers use of software deployment tools.