Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning

Alerts when Serv-U (\Serv-U.exe) spawns typical command interpreters or execution utilities on Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-07-14
Updated: 2026-07-30

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1555Credentials from Password Stores
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where a child process is launched by a parent process ending with \Serv-U.exe and the child command matches common script, shell, and system utility executables. This matters because exploited or abused Serv-U functionality may be used to run arbitrary commands through these interpreters and utilities. The detection relies on Windows process creation telemetry capturing ParentImage and Image paths ending in the specified patterns.

Reporting behind it

Related detections9 linkedT1555 — drag to rearrange

Suspicious Data Exfiltration via curl Multipart Upload to Gate Endpoint

Suspicious ALPHA SPIDER Veeam Backup Credential Extraction (via process_creation)

Malicious User Files Dump via Network Share - DonPapi, Lazagne (via security)

Malicious User Application Credentials Dump via Network Share - DonPapi, Lazagne (via security)

Malicious Veeam Credential Theft via PowerShell (via ps_script)

Malicious Credential Harvesting via LaZagne (via process_creation)

Suspicious Credential Prompt Phishing via osascript (via process_creation)

Suspicious Credential Store Access for WinSCP and PuTTY via PowerShell (via ps_script)

Malicious Veeam Credential Extraction via sqlcmd Query (via process_creation)

Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning

Pivot detection · T1555 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-parent-serv-u-exe-command-line-process-spawning-58f4ea09

title: "Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning"
id: 2f23055b-cbce-431f-8236-021b006e9ffa
status: test
description: This rule flags process creation events where a child process is launched by a parent process ending with \Serv-U.exe and the child command matches common script, shell, and system utility executables. This matters because exploited or abused Serv-U functionality may be used to run arbitrary commands through these interpreters and utilities. The detection relies on Windows process creation telemetry capturing ParentImage and Image paths ending in the specified patterns.
references:
  - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-14
modified: 2022-07-14
tags:
  - attack.credential-access
  - attack.t1555
  - cve.2021-35211
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \Serv-U.exe
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
      - \cscript.exe
      - \sh.exe
      - \bash.exe
      - \schtasks.exe
      - \regsvr32.exe
      - \wmic.exe
      - \mshta.exe
      - \rundll32.exe
      - \msiexec.exe
      - \forfiles.exe
      - \scriptrunner.exe
  condition: selection
falsepositives:
  - Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution
level: high
license: DRL-1.1
related:
  - id: 58f4ea09-0fc2-4520-ba18-b85c540b0eaf
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL