Windows: Suspicious Child Command Execution by SolarWinds WebHelpDesk (WHD)
Alerts on WebHelpDesk (bin) spawning tool-like child processes with download/execution command patterns on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where the parent process is SolarWinds WebHelpDesk (WHD) binaries running Java (java.exe/javaw.exe) with a Tomcat-related command line, and the spawned child process command line contains common scripting and download/execution utilities. Such child process patterns are frequently used during exploitation and post-exploitation to fetch payloads or run commands. The detection relies on process creation telemetry, including the parent image and command line, as well as the child process command line.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
- huntress.comhttps://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399
- documentation.solarwinds.comhttps://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-40551/proc_creation_win_exploit_cve_2025_40551.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious Child Command Execution by SolarWinds WebHelpDesk (WHD)"
id: 90daf23e-823c-4ce3-8ca2-82cc81fe0a8a
status: experimental
description: This rule flags Windows process creation where the parent process is SolarWinds WebHelpDesk (WHD) binaries running Java (java.exe/javaw.exe) with a Tomcat-related command line, and the spawned child process command line contains common scripting and download/execution utilities. Such child process patterns are frequently used during exploitation and post-exploitation to fetch payloads or run commands. The detection relies on process creation telemetry, including the parent image and command line, as well as the child process command line.
references:
- https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
- https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399
- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-40551/proc_creation_win_exploit_cve_2025_40551.yml
author: Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-02-11
tags:
- attack.initial-access
- attack.t1190
- cve.2025-26399
- cve.2025-40536
- cve.2025-40551
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: \WebHelpDesk\bin\
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentCommandLine|contains: tomcat
selection_suspicious_child:
CommandLine|contains:
- -enc
- base64
- bitsadmin
- certutil
- curl
- Invoke-RestMethod
- Invoke-WebRequest
- "irm "
- "iwr "
- mshta
- msiexec
- Net.WebClient
- Start-BitsTransfer
- wget
- wmic
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 8c7f4a2d-3b9e-4f1c-9a6d-2e8f5c3d9a1b
type: derived