Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning

Alerts when Serv-U (\Serv-U.exe) spawns typical command interpreters or execution utilities on Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-07-14
Updated: 2026-07-30

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1555Credentials from Password Stores
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where a child process is launched by a parent process ending with \Serv-U.exe and the child command matches common script, shell, and system utility executables. This matters because exploited or abused Serv-U functionality may be used to run arbitrary commands through these interpreters and utilities. The detection relies on Windows process creation telemetry capturing ParentImage and Image paths ending in the specified patterns.

Reporting behind it

Related detections9 linkedT1555 — drag to rearrange

Malicious Veeam Backup Credential Theft via psql Query of Credentials Table (via process_creation)

Possible SCOM RunAs Credential Theft via Access to Common MOMBins Encryption Key

Suspicious AMOS Stealer Fake Password Prompt via osascript (via process_creation)

Suspicious macOS Credential Validation via dscl authonly

Malicious Browser Credential Theft via rundll32 Loading move.dll (via process_creation)

Suspicious Data Exfiltration via curl Multipart Upload to Gate Endpoint

Suspicious ALPHA SPIDER Veeam Backup Credential Extraction (via process_creation)

Malicious User Files Dump via Network Share - DonPapi, Lazagne (via security)

Malicious User Application Credentials Dump via Network Share - DonPapi, Lazagne (via security)

Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning

Pivot detection · T1555 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-parent-serv-u-exe-command-line-process-spawning-58f4ea09

title: "Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning"
id: 2f23055b-cbce-431f-8236-021b006e9ffa
status: test
description: This rule flags process creation events where a child process is launched by a parent process ending with \Serv-U.exe and the child command matches common script, shell, and system utility executables. This matters because exploited or abused Serv-U functionality may be used to run arbitrary commands through these interpreters and utilities. The detection relies on Windows process creation telemetry capturing ParentImage and Image paths ending in the specified patterns.
references:
  - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-14
modified: 2022-07-14
tags:
  - attack.credential-access
  - attack.t1555
  - cve.2021-35211
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \Serv-U.exe
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
      - \cscript.exe
      - \sh.exe
      - \bash.exe
      - \schtasks.exe
      - \regsvr32.exe
      - \wmic.exe
      - \mshta.exe
      - \rundll32.exe
      - \msiexec.exe
      - \forfiles.exe
      - \scriptrunner.exe
  condition: selection
falsepositives:
  - Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution
level: high
license: DRL-1.1
related:
  - id: 58f4ea09-0fc2-4520-ba18-b85c540b0eaf
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL