Defending Against Disruption: Managing and Detecting Windows 11 25H2 Force Upgrades

---
title: Windows Update Agent Performing Upgrade Operations
id: 6c7f8e90-1a2b-3c4d-5e6f-7a8b9c0d1e2f
status: experimental
description: Detects the Windows Update Agent (usoclient.exe) initiating update installations which may include forced enablement packages for OS upgrades.
references:
  - https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-logs
author: Security Arsenal
date: 2025/03/29
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\usoclient.exe'
    CommandLine|contains:
      - 'StartInstall'
      - 'ScanInstallWait'
      - 'ResumeUpdate'
falsepositives:
  - Legitimate administrative software updates
level: medium
---
title: Windows OS Build Version Changed to 25H2
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects registry modifications indicating the OS build has changed to Windows 11 25H2 (Build 26100+), suggesting a force upgrade occurred.
references:
  - https://support.microsoft.com/en-us/topic/windows-11-release-information-3f4bb753-bce1-4fe3-9e6f-5bb79c65980b
author: Security Arsenal
date: 2025/03/29
tags:
  - attack.persistence
  - attack.t1542.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuild'
    Details|contains: '26100'
condition: selection
falsepositives:
  - Authorized IT upgrades
level: high
---
title: Windows Setup Executable Started
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects the execution of Windows Setup components, often involved during force OS upgrades or enablement packages.
references:
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2025/03/29
tags:
  - attack.privilege_escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\setupprep.exe'
  condition: selection
falsepositives:
  - Planned Windows upgrades by administrators
level: medium

// Detect Windows Update Agent initiating forced installations
DeviceProcessEvents
| where FolderPath endswith @"\usoclient.exe"
| where ProcessCommandLine contains "StartInstall" or ProcessCommandLine contains "ScanInstallWait" or ProcessCommandLine contains "ResumeUpdate"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc


// Hunt for devices reporting Build 26100 (25H2)
DeviceInfo
| where OSVersion contains "26100"
| project Timestamp, DeviceName, OSVersion, OSPlatform
| order by Timestamp desc

-- Hunt for Windows 11 25H2 (Build 26100) installations via Registry
SELECT 
  OSPath,
  Mtime,
  Data.value AS BuildNumber
FROM glob(globs="C:\Windows\System32\Config\SYSTEM")
WHERE parse_xml(file=read_file(filename=OSPath)).
      // Note: This is a simplified logical check for VQL illustration.
      // In practice, use the registry() plugin for direct access.
      TRUE
-- Actual practical query for registry:
SELECT 
  Key.FullPath, 
  Key.Data.Value AS CurrentBuild
FROM registry(globs='HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion')
WHERE Name = "CurrentBuild" AND Value = "26100"


-- Hunt for active Windows Update processes
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ "usoclient" OR Name =~ "wuauclt" OR Name =~ "setupprep"

<#
.SYNOPSIS
    Check Windows Version and Defer Feature Updates if possible.
#>

# 1. Check Current Build
$buildInfo = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
Write-Host "Current Product Name: $($buildInfo.ProductName)"
Write-Host "Current Build Number: $($buildInfo.CurrentBuild)"

if ($buildInfo.CurrentBuild -ge 26100) {
    Write-Warning "System is already on Windows 11 25H2 (Build 26100+)."
} else {
    Write-Host "System is on a pre-25H2 build."
}

# 2. Attempt to Defer Feature Updates (Requires Windows Pro/Enterprise and Admin Rights)
try {
    $policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
    if (-not (Test-Path $policyPath)) { New-Item -Path $policyPath -Force }
    
    # Set DeferFeatureUpdates to 1 (Enable deferral)
    Set-ItemProperty -Path $policyPath -Name "DeferFeatureUpdates" -Value 1 -Type DWord
    Set-ItemProperty -Path $policyPath -Name "DeferFeatureUpdatesPeriodInDays" -Value 365 -Type DWord
    
    Write-Host "Successfully configured policy to defer feature updates for 365 days."
} catch {
    Write-Error "Failed to set update deferral policy. Ensure you are running as Administrator."
}