Windows Exchange UMWorkerProcess File Drops Indicating CVE-2021-26858 Exploitation

Alerts on Exchange Unified Messaging (UMWorkerProcess.exe) creating unusual files, excluding common benign names consistent with CVE-2021-26858 activity.

FreeReviewedSigma · High · v5

Product: windows
Category: file_event
Author: Bhabesh Raj (SigmaHQ), DRL 1.1
Published: 2021-03-03
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation events where the process name ends with UMWorkerProcess.exe, which is associated with Exchange Unified Messaging. It filters out specific benign-looking target filenames and alerts on other non-standard files that could represent dropped web shells or other attacker content following exploitation. The detection relies on Windows file event telemetry that captures the writing process and the target filename.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Suspicious Execution From WinRAR Temporary Extraction Path via Command Line (via process_creation)

Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit

Suspicious Network Connection From CUPS Foomatic-Rip Child Process

Antivirus signatures matching APT malware naming patterns

Antivirus Remote Access Tool Signature Matches Known RAT Names

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Windows Exchange UMWorkerProcess File Drops Indicating CVE-2021-26858 Exploitation

Pivot detection · T1203 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-exchange-unified-messaging-process-drops-suspicious-files-indicating-cve-b06335b3

title: Windows Exchange UMWorkerProcess File Drops Indicating CVE-2021-26858 Exploitation
id: 8352a7a2-ce03-4040-b346-20cf4209573b
status: test
description: This rule flags file creation events where the process name ends with UMWorkerProcess.exe, which is associated with Exchange Unified Messaging. It filters out specific benign-looking target filenames and alerts on other non-standard files that could represent dropped web shells or other attacker content following exploitation. The detection relies on Windows file event telemetry that captures the writing process and the target filename.
references:
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26858/file_event_win_cve_2021_26858_msexchange.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-03-03
modified: 2022-10-09
tags:
  - attack.t1203
  - attack.execution
  - cve.2021-26858
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: UMWorkerProcess.exe
  filter:
    TargetFilename|endswith:
      - CacheCleanup.bin
      - .txt
      - .LOG
      - .cfg
      - cleanup.bin
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b06335b3-55ac-4b41-937e-16b7f5d57dfd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL