Windows Server Update Services

Event	Title	Channel	Sample	Rule
501	Event ID 501	Application	Y	N
502	Event ID 502	Application	Y	N
7053	The WSUS administration console has encountered an unexpected error.	Application	N	Y
12000	Event ID 12000	Application	Y	N
12002	Event ID 12002	Application	Y	N
12010	Event ID 12010	Application	Y	N
12012	Event ID 12012	Application	Y	N
12020	Event ID 12020	Application	Y	N
12022	Event ID 12022	Application	Y	N
12030	Event ID 12030	Application	Y	N
12032	Event ID 12032	Application	Y	N
12040	Event ID 12040	Application	Y	N
12042	Event ID 12042	Application	Y	N
12050	Event ID 12050	Application	Y	N
12052	Event ID 12052	Application	Y	N
12070	Event ID 12070	Application	Y	N
12072	Event ID 12072	Application	Y	N
13040	Event ID 13040	Application	Y	N
13042	Event ID 13042	Application	Y	N
13051	Event ID 13051	Application	Y	N

Event ID 501

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 501,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 16:59:32.807997+00:00",
    "event_record_id": 466,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Update Services Service Started</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 502

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 502,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:24:01.642078+00:00",
    "event_record_id": 854,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Update Services Service Has Stopped</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 7053: The WSUS administration console has encountered an unexpected error.

Channel: Application

Description

Generic unhandled-exception event emitted by the WSUS server application (its ASP.NET/WCF web services and MMC console backend) whenever that code throws an unhandled .NET exception. The Description is a fixed preamble followed by the actual CLR exception type, message, and stack trace, so this id has no single fixed meaning.

Fields #

Name	Description	Rules
`Data`	Rendered exception text: the preamble plus the CLR exception type, message, and stack trace.	1 detection rule

Community Notes #

Benign historically (corrupted XML responses, SQL timeouts, IIS memory pressure). Matched by the SigmaHQ 'CVE-2025-59287 WSUS Deserialization' rule when the rendered exception is a System.InvalidCastException naming System.Windows.Data.ObjectDataProvider and System.Windows.Media.Brush, the ysoserial.net gadget signature of the WSUS AuthorizationCookie BinaryFormatter deserialization exploit. The event carries a single unstructured Description blob, not discrete fields.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Exploitation Activity of CVE-2025-59287 - WSUS Deserialization source high: Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS.T1190, T1203

References #

Event ID 12000

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12000,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7778,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Reporting Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12002

Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12002,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2725,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Reporting Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12010

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12010,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7779,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The API Remoting Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12012

Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12012,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2726,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The API Remoting Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12020

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12020,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7781,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Client Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12022

Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12022,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2728,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Client Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12030

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12030,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7780,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Server Synchronization Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12032

Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12032,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2727,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Server Synchronization Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12040

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12040,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.389688+00:00",
    "event_record_id": 7782,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The SimpleAuth Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12042

Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12042,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2729,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The SimpleAuth Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12050

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12050,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.389688+00:00",
    "event_record_id": 7783,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The DSS Authentication Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12052

Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12052,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2730,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The DSS Authentication Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12070

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12070,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.389688+00:00",
    "event_record_id": 7784,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The WSUS content directory is accessible.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12072

Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12072,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2731,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The WSUS content directory is not accessible.\nSystem.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 10.4.10.11:8530\n   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)\n   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)\n   --- End of inner exception stack trace ---\n   at System.Net.HttpWebRequest.GetResponse()\n   at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger)</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 13040

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 13040,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7777,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Self-update is working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 13042

Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 13042,
    "version": 0,
    "level": 2,
    "task": 6,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2723,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Self-update is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 13051

Channel: Application
Level: 3

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 13051,
    "version": 0,
    "level": 3,
    "task": 6,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 16:59:40.953760+00:00",
    "event_record_id": 467,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>No client computers have ever contacted the server.</string>\n",
    "Binary": ""
  },
  "message": ""
}