Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning

title: "Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning"
id: 2f23055b-cbce-431f-8236-021b006e9ffa
status: test
description: This rule flags process creation events where a child process is launched by a parent process ending with \Serv-U.exe and the child command matches common script, shell, and system utility executables. This matters because exploited or abused Serv-U functionality may be used to run arbitrary commands through these interpreters and utilities. The detection relies on Windows process creation telemetry capturing ParentImage and Image paths ending in the specified patterns.
references:
  - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-14
modified: 2022-07-14
tags:
  - attack.credential-access
  - attack.t1555
  - cve.2021-35211
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \Serv-U.exe
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
      - \cscript.exe
      - \sh.exe
      - \bash.exe
      - \schtasks.exe
      - \regsvr32.exe
      - \wmic.exe
      - \mshta.exe
      - \rundll32.exe
      - \msiexec.exe
      - \forfiles.exe
      - \scriptrunner.exe
  condition: selection
falsepositives:
  - Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution
level: high
license: DRL-1.1
related:
  - id: 58f4ea09-0fc2-4520-ba18-b85c540b0eaf
    type: derived