Windows Exchange UMWorkerProcess Subprocess Launching Indicative of CVE-2021-26857

Detects suspicious child process spawning by Exchange Unified Messaging (UMWorkerProcess.exe) associated with CVE-2021-26857 attempts.

FreeUnreviewedSigmahighv1

windows-exchange-umworkerprocess-subprocess-launching-indicative-of-cve-2021-268-cd479ccc

title: Windows Exchange UMWorkerProcess Subprocess Launching Indicative of CVE-2021-26857
id: bd4a9fbf-e712-4e09-87b7-3f78bfb6beb3
status: stable
description: This rule flags process-creation events where the parent process is Exchange Unified Messaging (UMWorkerProcess.exe) and it spawns an abnormal child process. Attackers may leverage this behavior to execute payloads through the Exchange component, making parent/child process relationships important for spotting exploitation attempts. The detection relies on Windows process creation telemetry, specifically the parent image ending with UMWorkerProcess.exe and the spawned image not matching common exclusions (wermgr.exe, WerFault.exe).
references:
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26857/proc_creation_win_exploit_cve_2021_26857_msexchange.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-03-03
modified: 2023-02-07
tags:
  - attack.t1203
  - attack.execution
  - cve.2021-26857
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \UMWorkerProcess.exe
  filter:
    Image|endswith:
      - wermgr.exe
      - WerFault.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: cd479ccc-d8f0-4c66-ba7d-e06286f3f887
    type: derived

What it detects

This rule flags process-creation events where the parent process is Exchange Unified Messaging (UMWorkerProcess.exe) and it spawns an abnormal child process. Attackers may leverage this behavior to execute payloads through the Exchange component, making parent/child process relationships important for spotting exploitation attempts. The detection relies on Windows process creation telemetry, specifically the parent image ending with UMWorkerProcess.exe and the spawned image not matching common exclusions (wermgr.exe, WerFault.exe).

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.