Windows Process Creation: Suspected CVE-2021-26857 Exploitation via UMWorkerProcess.exe

Detects suspicious child process spawning by Exchange Unified Messaging (UMWorkerProcess.exe) associated with CVE-2021-26857 attempts.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Bhabesh Raj (SigmaHQ), DRL 1.1
Published: 2021-03-03
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where a child process is spawned by Exchange Unified Messaging (UM) Worker process (UMWorkerProcess.exe), excluding known benign termination and fault-handler executables. Attackers attempting exploitation for CVE-2021-26857 may trigger abnormal subprocess execution from the UM component. The detection relies on process creation telemetry, specifically parent-child relationships and executable paths ending with UMWorkerProcess.exe and the excluded binaries.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Suspicious Execution From WinRAR Temporary Extraction Path via Command Line (via process_creation)

Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit

Suspicious Network Connection From CUPS Foomatic-Rip Child Process

Antivirus signatures matching APT malware naming patterns

Antivirus Remote Access Tool Signature Matches Known RAT Names

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Windows Process Creation: Suspected CVE-2021-26857 Exploitation via UMWorkerProcess.exe

Pivot detection · T1203 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-exchange-umworkerprocess-subprocess-launching-indicative-of-cve-2021-268-cd479ccc

title: "Windows Process Creation: Suspected CVE-2021-26857 Exploitation via UMWorkerProcess.exe"
id: bd4a9fbf-e712-4e09-87b7-3f78bfb6beb3
status: stable
description: This rule flags Windows process creation events where a child process is spawned by Exchange Unified Messaging (UM) Worker process (UMWorkerProcess.exe), excluding known benign termination and fault-handler executables. Attackers attempting exploitation for CVE-2021-26857 may trigger abnormal subprocess execution from the UM component. The detection relies on process creation telemetry, specifically parent-child relationships and executable paths ending with UMWorkerProcess.exe and the excluded binaries.
references:
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26857/proc_creation_win_exploit_cve_2021_26857_msexchange.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-03-03
modified: 2023-02-07
tags:
  - attack.t1203
  - attack.execution
  - cve.2021-26857
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \UMWorkerProcess.exe
  filter:
    Image|endswith:
      - wermgr.exe
      - WerFault.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: cd479ccc-d8f0-4c66-ba7d-e06286f3f887
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL