Windows: Suspicious Child Command Execution by SolarWinds WebHelpDesk (WHD)

Alerts on WebHelpDesk (bin) spawning tool-like child processes with download/execution command patterns on Windows.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-02-11
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation where the parent process is SolarWinds WebHelpDesk (WHD) binaries running Java (java.exe/javaw.exe) with a Tomcat-related command line, and the spawned child process command line contains common scripting and download/execution utilities. Such child process patterns are frequently used during exploitation and post-exploitation to fetch payloads or run commands. The detection relies on process creation telemetry, including the parent image and command line, as well as the child process command line.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Ingress-nginx Configuration Injection via Kubernetes Audit (via kubernetes)

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious MS-SQL Server Spawning Command Shell via Mallox

Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget

Malicious WordPress Core SQL Injection Scanner via User-Agent

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Windows: Suspicious Child Command Execution by SolarWinds WebHelpDesk (WHD)

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-child-process-behavior-from-solarwinds-webhelpdesk-webhelpdes-8c7f4a2d

title: "Windows: Suspicious Child Command Execution by SolarWinds WebHelpDesk (WHD)"
id: 90daf23e-823c-4ce3-8ca2-82cc81fe0a8a
status: experimental
description: This rule flags Windows process creation where the parent process is SolarWinds WebHelpDesk (WHD) binaries running Java (java.exe/javaw.exe) with a Tomcat-related command line, and the spawned child process command line contains common scripting and download/execution utilities. Such child process patterns are frequently used during exploitation and post-exploitation to fetch payloads or run commands. The detection relies on process creation telemetry, including the parent image and command line, as well as the child process command line.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
  - https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399
  - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-40551/proc_creation_win_exploit_cve_2025_40551.yml
author: Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-02-11
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2025-26399
  - cve.2025-40536
  - cve.2025-40551
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \WebHelpDesk\bin\
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentCommandLine|contains: tomcat
  selection_suspicious_child:
    CommandLine|contains:
      - -enc
      - base64
      - bitsadmin
      - certutil
      - curl
      - Invoke-RestMethod
      - Invoke-WebRequest
      - "irm "
      - "iwr "
      - mshta
      - msiexec
      - Net.WebClient
      - Start-BitsTransfer
      - wget
      - wmic
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8c7f4a2d-3b9e-4f1c-9a6d-2e8f5c3d9a1b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL