huntrule

Windows Process Creation: Suspected CVE-2021-26857 Exploitation via UMWorkerProcess.exe

Detects suspicious child process spawning by Exchange Unified Messaging (UMWorkerProcess.exe) associated with CVE-2021-26857 attempts.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
Bhabesh Raj (SigmaHQ), DRL 1.1
Published
2021-03-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where a child process is spawned by Exchange Unified Messaging (UM) Worker process (UMWorkerProcess.exe), excluding known benign termination and fault-handler executables. Attackers attempting exploitation for CVE-2021-26857 may trigger abnormal subprocess execution from the UM component. The detection relies on process creation telemetry, specifically parent-child relationships and executable paths ending with UMWorkerProcess.exe and the excluded binaries.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange
Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831
Suspicious Execution From WinRAR Temporary Extraction Path via Command Line (via process_creation)
Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit
Suspicious Network Connection From CUPS Foomatic-Rip Child Process
Antivirus signatures matching APT malware naming patterns
Antivirus Remote Access Tool Signature Matches Known RAT Names
Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)
Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)
Malicious Equation Editor Child Process Execution via process_creation
Windows Process Creation: Suspected CVE-2021-26857 Exploitation via UMWorkerProcess.exe
Pivot detection · T1203 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.