Microsoft Windows Update Certificate Rotation: Unsupported Windows Versions to Lose Security Updates — Defender's Playbook

---
title: Windows Update Service Disabled or Deleted
id: 3f8c2d71-6a94-4b1e-9c37-2e8a5d4f6b01
status: experimental
description: Detects attempts to disable, stop, or delete the Windows Update service (wuauserv) via command-line tooling. Common attacker behavior post-compromise and a key indicator of devices that will silently miss security updates, including during certificate rotation events.
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains:
      - 'wuauserv'
      - 'UsoSvc'
      - 'WaaSMedicSvc'
  selection_action:
    CommandLine|contains:
      - 'stop'
      - 'delete'
      - 'config'
      - 'failure'
  selection_net:
    Image|endswith: '\net.exe'
    CommandLine|contains:
      - 'stop wuauserv'
      - 'stop usosvc'
  condition: (selection_sc and selection_action) or selection_net
falsepositives:
  - Administrators intentionally pausing updates during maintenance windows
  - Some patch-management tooling that temporarily stops the service
level: high
---
title: Windows Update Service Start Type Modified via Registry
id: 8b1e4f52-7c03-4d6a-b928-5f3c9e1a7d42
status: experimental
description: Detects registry modification setting the Windows Update service (wuauserv) to disabled. Disabling updates leaves hosts unable to receive certificate rotation updates and security patches.
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: 'SYSTEM\CurrentControlSet\Services\wuauserv'
    Details|contains: '0x00000004'
  condition: selection
falsepositives:
  - GPO-driven update management in tightly controlled environments
  - WSUS/Intune-managed devices may show Start value changes during policy transitions
level: medium

// Hunt 1: Identify devices running out-of-support Windows builds
// Adjust build lists to your environment's current servicing baseline
let EOSClientBuilds = dynamic(["10240","10586","14393","15063","16299","17134","17763","18362","18363","19041","19042","19043","19044","19045","22000","22621"]);
DeviceInfo
| where TimeGenerated > ago(1d)
| summarize arg_max(TimeGenerated, *) by DeviceId
| extend OSBuild = tostring(OSBuild)
| where OSBuild in (EOSClientBuilds)
| project DeviceName, OSDescription, OSVersion, OSBuild, OSPlatform, TimeGenerated
| sort by OSBuild asc;

// Hunt 2: Devices whose Windows Update service was stopped or reconfigured
let Lookback = 7d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where ProcessCommandLine has_any ("wuauserv", "UsoSvc", "WaaSMedicSvc")
| where ProcessCommandLine has_any ("stop", "disable", "delete", "config")
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "powershell.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName
| sort by TimeGenerated desc;

// Hunt 3: Servicing stack drift — devices with no successful update installation in 45+ days
// (requires Defender TVM or update compliance telemetry ingestion)
DeviceInfo
| where TimeGenerated > ago(1d)
| summarize arg_max(TimeGenerated, *) by DeviceId
| join kind=leftouter (
    DeviceEvents
    | where TimeGenerated > ago(45d)
    | where AdditionalFields has "KB"
    | summarize LastUpdateEvent=max(TimeGenerated) by DeviceId
) on DeviceId
| where isempty(LastUpdateEvent)
| project DeviceName, OSVersion, OSBuild, TimeGenerated

-- Identify end-of-support Windows builds and servicing drift across the fleet
-- Deploy as a hunt; flags hosts that will fail the certificate rotation
SELECT Name AS Hostname,
       Fqdn AS Domain,
       { SELECT Caption, Version, BuildNumber, InstallDate,
                LastBootUpTime
         FROM wmi(query="SELECT Caption, Version, BuildNumber, InstallDate, LastBootUpTime FROM Win32_OperatingSystem")
       } AS OS,
       { SELECT HotFixID, InstalledOn
         FROM wmi(query="SELECT HotFixID, InstalledOn FROM Win32_QuickFixEngineering")
       } AS Hotfixes
FROM pslist(pid=4)

# Windows Update Certificate Rotation Readiness Audit
# Run elevated. Produces a per-host readiness report for the 2026 rotation.

$report = [ordered]@{}

# --- 1. OS build and servicing status ---
$os = Get-CimInstance Win32_OperatingSystem
$build = [int]($os.BuildNumber)
$report.Hostname       = $env:COMPUTERNAME
$report.OSCaption      = $os.Caption
$report.BuildNumber    = $build
$report.InstallDate    = $os.InstallDate

# Flag known out-of-service client builds (update this list as servicing timelines move)
$eosBuilds = @(10240,10586,14393,15063,16299,17134,17763,18362,18363,19041,19042,19043,19044,19045,22000,22621)
$report.BuildOutOfService = $eosBuilds -contains $build

# --- 2. Windows Update service health ---
$wu = Get-Service -Name wuauserv -ErrorAction SilentlyContinue
$report.WUServiceStatus    = $wu.Status
$report.WUServiceStartType = (Get-CimInstance Win32_Service -Filter "Name='wuauserv'").StartMode

# --- 3. Servicing stack / last cumulative update age ---
$lastHotfix = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
$report.LastHotFixID   = $lastHotfix.HotFixID
$report.LastHotFixDate = $lastHotfix.InstalledOn
$report.DaysSincePatch = if ($lastHotfix.InstalledOn) {
    (New-TimeSpan -Start $lastHotfix.InstalledOn -End (Get-Date)).Days
} else { 'Unknown' }

# --- 4. Secure Boot state and DB certificate check (2026 cert expiry readiness) ---
$report.SecureBootEnabled = try { Confirm-SecureBootUEFI } catch { 'NotSupported/Legacy BIOS' }
if ($report.SecureBootEnabled -eq $true) {
    try {
        $dbBytes = (Get-SecureBootUEFI -Name db).Bytes
        $dbText  = [System.Text.Encoding]::ASCII.GetString($dbBytes)
        # Presence of the 2023 Windows UEFI CA indicates the updated DB has been applied
        $report.SecureBootDB2023Cert = $dbText -match 'Windows UEFI CA 2023'
    } catch {
        $report.SecureBootDB2023Cert = "QueryFailed: $($_.Exception.Message)"
    }
} else {
    $report.SecureBootDB2023Cert = 'N/A'
}

# --- 5. Windows Update root certificate presence ---
$wuCerts = Get-ChildItem Cert:\LocalMachine\Root |
    Where-Object { $_.Subject -match 'Microsoft' -and $_.EnhancedKeyUsageList.FriendlyName -match 'Windows Update' -or $_.Subject -match 'Microsoft Update' }
$report.UpdateRootCerts = ($wuCerts | ForEach-Object { "$($_.Subject) [expires $($_.NotAfter.ToString('yyyy-MM-dd'))]" }) -join '; '

# --- 6. Verdict ---
$report.ReadinessVerdict = if ($report.BuildOutOfService) {
    'FAIL - Out-of-service build: will NOT receive rotated certificates. Upgrade or enroll in ESU.'
} elseif ($report.DaysSincePatch -is [int] -and $report.DaysSincePatch -gt 60) {
    'WARN - Servicing stack likely stale; apply latest SSU/LCU before rotation.'
} elseif ($report.SecureBootDB2023Cert -eq $false) {
    'WARN - Secure Boot DB missing 2023 CA; apply Secure Boot certificate update.'
} else {
    'PASS'
}

[pscustomobject]$report | Format-List

# Optional: export for fleet-wide collection
# [pscustomobject]$report | Export-Csv -Path "\\share\wu-readiness\$env:COMPUTERNAME.csv" -NoTypeInformation