Windows Process Creation: Serv-U CVE-2021-35211 Exploitation Command Pattern
Alerts on Windows process commands that combine 'whoami' with Serv-U-specific execution path and temp batch patterns tied to CVE-2021-35211.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-07-14
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies Windows command-line activity that includes running whoami alongside paths and execution of Serv-U batch content consistent with exploitation activity for CVE-2021-35211. Attackers often use host/user discovery (whoami) and drop or invoke component scripts located under Client/Common and from C:\Windows\Temp\Serv-U.bat. The rule relies on process creation telemetry with captured command-line arguments.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-35211/proc_creation_win_exploit_cve_2021_35211_servu.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Serv-U CVE-2021-35211 Exploitation Command Pattern"
id: 52f552c9-6f77-4c54-b092-64338ca185d5
status: test
description: Identifies Windows command-line activity that includes running whoami alongside paths and execution of Serv-U batch content consistent with exploitation activity for CVE-2021-35211. Attackers often use host/user discovery (whoami) and drop or invoke component scripts located under Client/Common and from C:\Windows\Temp\Serv-U.bat. The rule relies on process creation telemetry with captured command-line arguments.
references:
- https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-35211/proc_creation_win_exploit_cve_2021_35211_servu.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-14
modified: 2022-12-18
tags:
- attack.persistence
- attack.t1136.001
- cve.2021-35211
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_whoami:
CommandLine|contains: whoami
selection_cmd_1:
CommandLine|contains:
- ./Client/Common/
- .\Client\Common\
selection_cmd_2:
CommandLine|contains: C:\Windows\Temp\Serv-U.bat
condition: selection_whoami and 1 of selection_cmd*
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 75578840-9526-4b2a-9462-af469a45e767
type: derived