Microsoft October Windows Server Updates Break Exchange OWA Sign-In and Mail Flow — Detection, Rollback, and Remediation Guide

---
title: Security Update Removal via WUSA or DISM on Exchange Servers
id: 3f9b2c41-7a5e-4d18-bf62-9c1e4a7d2035
status: experimental
description: Detects uninstallation of Windows updates via wusa.exe or DISM. During the October Windows Server / Exchange regression, administrators may roll back the problematic update — this rule provides visibility and audit trail for that activity, and also catches unauthorized update removal by attackers weakening patch posture.
references:
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-october-windows-server-updates-cause-exchange-issues/
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1562
logsource:
  category: process_creation
  product: windows
detection:
  selection_wusa:
    Image|endswith: '\wusa.exe'
    CommandLine|contains:
      - '/uninstall'
      - '/kb:'
  selection_dism:
    Image|endswith:
      - '\dism.exe'
      - '\dismhost.exe'
    CommandLine|contains:
      - '/Remove-Package'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Remove-WindowsPackage'
      - 'Uninstall-WindowsUpdate'
  condition: 1 of selection_*
falsepositives:
  - Legitimate patch rollback performed by Exchange/Windows administrators during incident response
level: medium
---
title: Exchange Service Stop or Restart via Command Line
id: 8c4d1e76-2b93-4f05-a1c8-6e7b3d9f4a21
status: experimental
description: Detects sc.exe, net.exe, or PowerShell being used to stop or restart Microsoft Exchange services. Legitimate during remediation of the October update regression (transport service restarts), but also a known precursor to ransomware staging and tampering with mail security controls.
references:
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-october-windows-server-updates-cause-exchange-issues/
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
  selection_action:
    CommandLine|contains:
      - 'stop'
      - 'disable'
  selection_service:
    CommandLine|contains:
      - 'MSExchange'
      - 'W3SVC'
  condition: selection_tool and selection_action and selection_service
falsepositives:
  - Administrators restarting Exchange services during patch remediation or maintenance windows
level: medium

// Hunt 1: Identify Exchange servers exhibiting OWA auth/application failures after October patching.
// Looks for a spike in 401/500 responses on /owa/ and /ecp/ virtual directories in IIS logs ingested to Sentinel.
let PatchWindowStart = datetime(2025-10-14);
W3CIISLog
| where TimeGenerated >= PatchWindowStart
| where csUriStem startswith "/owa" or csUriStem startswith "/ecp"
| where sc-status in ("401", "500", "502", "503")
| summarize FailureCount = count(),
            DistinctUsers = dcount(csUserName),
            Statuses = make_set(sc-status),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
  by Computer, csUriStem, bin(TimeGenerated, 1h)
| where FailureCount > 50
| sort by TimeGenerated desc;

// Hunt 2: Exchange transport and IIS worker processes terminating or restarting unexpectedly post-update.
// Uses Defender for Endpoint device events on servers identified as Exchange hosts.
DeviceEvents
| where TimeGenerated >= ago(14d)
| where ActionType == "ServiceStopped" or ActionType == "ServiceInstalled"
| where AdditionalFields has_any ("MSExchange", "W3SVC", "MSExchangeTransport")
| project TimeGenerated, DeviceName, ActionType, ServiceName = tostring(AdditionalFields.ServiceName), InitiatingProcessFileName, InitiatingProcessAccountName
| sort by TimeGenerated desc;

// Hunt 3: Inventory servers that installed updates during the October window — scope the blast radius.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("TiWorker.exe", "wuauclt.exe", "wusa.exe", "UsoClient.exe")
   or ProcessCommandLine has_any ("KB50", "/uninstall", "Remove-Package")
| summarize UpdateActivity = make_set(ProcessCommandLine), LastActivity = max(TimeGenerated) by DeviceName
| sort by LastActivity desc

-- Artifact: Exchange_Update_Regression_Triage
-- Purpose: Identify Exchange servers with recent Windows updates installed and check
-- the live state of Exchange/IIS services for the October update regression.

-- 1) Recently installed hotfixes (approximate install date via folder/file timestamps)
LET updates = SELECT Name, Description, HotFixID, InstalledOn
FROM wmi(query='SELECT HotFixID, Description, InstalledOn FROM Win32_QuickFixEngineering', namespace='root/cimv2')

SELECT HotFixID, Description, InstalledOn
FROM updates
ORDER BY InstalledOn DESC

-- 2) Exchange and IIS service state — look for stopped/hung transport or IIS services
LET services = SELECT Name, DisplayName, State, StartMode
FROM wmi(query="SELECT Name, DisplayName, State, StartMode FROM Win32_Service WHERE Name LIKE 'MSExchange%' OR Name IN ('W3SVC','WAS')", namespace='root/cimv2')

SELECT Name, DisplayName, State, StartMode,
       if(condition=State != 'Running', then='INVESTIGATE', else='OK') AS Assessment
FROM services

-- 3) Live process view — confirm w3wp app pools and transport processes are alive
SELECT Pid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)w3wp|MSExchangeTransport|MSExchangeDelivery|MSExchangeSubmission'

# Exchange-Triage-OctUpdate.ps1
# Run elevated on each Exchange server. Identifies recent updates, checks Exchange health,
# and optionally rolls back a specified KB as a LAST RESORT with full audit output.

param(
    [string]$KbToRemove = ""   # e.g. "KB5000000" — only populate after confirming the known issue applies
)

$report = @()

# 1) List updates installed in the last 30 days
Write-Host "[+] Recently installed updates:" -ForegroundColor Cyan
$recent = Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-30) } | Sort-Object InstalledOn -Descending
$recent | Format-Table HotFixID, Description, InstalledOn -AutoSize
$report += $recent

# 2) Exchange service health
Write-Host "[+] Exchange service status:" -ForegroundColor Cyan
$services = Get-Service | Where-Object { $_.Name -like "MSExchange*" -or $_.Name -in @("W3SVC","WAS") }
$services | Format-Table Name, Status, StartType -AutoSize
$stopped = $services | Where-Object { $_.Status -ne "Running" -and $_.StartType -eq "Automatic" }
if ($stopped) { Write-Warning "Stopped automatic-start services found: $($stopped.Name -join ', ')" }

# 3) IIS application pool state (OWA sign-in depends on these)
Import-Module WebAdministration -ErrorAction SilentlyContinue
if (Get-Module WebAdministration) {
    Write-Host "[+] Exchange IIS app pools:" -ForegroundColor Cyan
    Get-ChildItem IIS:\AppPools | Where-Object { $_.Name -like "MSExchange*" } |
        Select-Object Name, State | Format-Table -AutoSize
}

# 4) OWA local smoke test
Write-Host "[+] Testing local OWA endpoint..." -ForegroundColor Cyan
try {
    $resp = Invoke-WebRequest -Uri "https://localhost/owa/auth/logon.aspx" -UseBasicParsing -TimeoutSec 15 -SkipCertificateCheck
    Write-Host "    OWA responded with HTTP $($resp.StatusCode)" -ForegroundColor Green
} catch {
    Write-Warning "OWA check failed: $($_.Exception.Message)"
}

# 5) Transport queue depth — mail flow health
Write-Host "[+] Transport queues:" -ForegroundColor Cyan
try { Get-Queue -ErrorAction Stop | Format-Table Identity, DeliveryType, Status, MessageCount -AutoSize }
catch { Write-Warning "Get-Queue failed — run from Exchange Management Shell if queues must be checked." }

# 6) Optional rollback — LAST RESORT, coordinate with change control
if ($KbToRemove -ne "") {
    Write-Warning "Rolling back $KbToRemove removes security fixes. Ensure compensating monitoring is in place."
    $confirm = Read-Host "Type ROLLBACK to proceed with uninstall of $KbToRemove"
    if ($confirm -eq "ROLLBACK") {
        Start-Process wusa.exe -ArgumentList "/uninstall /kb:$($KbToRemove -replace 'KB','') /norestart" -Wait
        Write-Host "[+] Uninstall invoked. Reboot required to complete." -ForegroundColor Yellow
    }
}

$report | Export-Csv -Path ".\Exchange-OctUpdate-Triage-$(Get-Date -Format 'yyyyMMdd-HHmm').csv" -NoTypeInformation
Write-Host "[+] Triage report exported." -ForegroundColor Green