After obtaining access to a WSUS server used by target clients, SharpWSUS can add a Windows-signed update payload and approve it for a computer group. Clients download and install it according to their check-in and update policy; the resulting execution can support lateral movement, but approval is not evidence that a client installed the update or that the intended payload effect succeeded.
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
SharpWSUS · Create WSUS Update
Create WSUS Update
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.preconditions: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKERcleanup: RESTRICTED_ACCESS_BLUR_MARKER