mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 17:58:52 +00:00
e0f166aba2
https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
36 lines
1.2 KiB
YAML
36 lines
1.2 KiB
YAML
title: Suspicious Serv-U Process Pattern
|
|
id: 75578840-9526-4b2a-9462-af469a45e767
|
|
status: experimental
|
|
description: Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
|
|
author: Florian Roth
|
|
date: 2021/07/14
|
|
references:
|
|
- https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
tags:
|
|
- cve.2021-35211
|
|
detection:
|
|
selection:
|
|
ParentImage|endswith: '\Serv-U.exe'
|
|
Image|endswith:
|
|
- '\cmd.exe'
|
|
- '\powershell.exe'
|
|
- '\wscript.exe'
|
|
- '\cscript.exe'
|
|
- '\sh.exe'
|
|
- '\bash.exe'
|
|
- '\schtasks.exe'
|
|
- '\regsvr32.exe'
|
|
- '\wmic.exe' # https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/
|
|
- '\mshta.exe'
|
|
- '\rundll32.exe'
|
|
- '\msiexec.exe'
|
|
- '\forfiles.exe'
|
|
- '\scriptrunner.exe'
|
|
condition: selection
|
|
falsepositives:
|
|
- Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution
|
|
level: critical
|