Windows Process Creation: Serv-U CVE-2021-35211 Exploitation via whoami and Client/Common Paths

title: "Windows Process Creation: Serv-U CVE-2021-35211 Exploitation via whoami and Client/Common Paths"
id: 52f552c9-6f77-4c54-b092-64338ca185d5
status: test
description: This rule flags Windows process creation events where the command line includes 'whoami' and also contains patterns tied to Serv-U client/common execution paths and a temporary batch file reference. Such behavior can indicate post-exploitation discovery of the current user and execution steps consistent with activity targeting CVE-2021-35211. The detection relies on process creation telemetry, specifically the CommandLine field matching the listed substrings.
references:
  - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-35211/proc_creation_win_exploit_cve_2021_35211_servu.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-14
modified: 2022-12-18
tags:
  - attack.persistence
  - attack.t1136.001
  - cve.2021-35211
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_whoami:
    CommandLine|contains: whoami
  selection_cmd_1:
    CommandLine|contains:
      - ./Client/Common/
      - .\Client\Common\
  selection_cmd_2:
    CommandLine|contains: C:\Windows\Temp\Serv-U.bat
  condition: selection_whoami and 1 of selection_cmd*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 75578840-9526-4b2a-9462-af469a45e767
    type: derived