WSUKS

Summary from the TLDR InfoSec newsletter

The "wsuks" tool automates man-in-the-middle attacks on Windows Server Update Service (WSUS) configs using HTTP instead of HTTPS. It uses ARP spoofing to impersonate the WSUS server. It serves malicious updates with PsExec64.exe and PowerShell scripts that run as SYSTEM to create local admin users or add domain users to the local administrators group.