Tag
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability Allows Privilege Escalation and RCE
3 TTPs 4 CVEsA critical insecure direct object reference (IDOR) vulnerability, CVE-2026-28302, in SolarWinds Serv-U allows authenticated group administrators to achieve privilege escalation and remote code execution as root.
Suspicious SolarWinds Web Help Desk Java Module Load or Child Process
2 rules 1 TTP 2 CVEsDetects suspicious behavior related to SolarWinds Web Help Desk, specifically the loading of untrusted native modules (DLLs) or the spawning of suspicious child processes (cmd, PowerShell, rundll32) by the Java process, potentially indicating exploitation of deserialization vulnerabilities CVE-2025-40536 and CVE-2025-40551.
Critical Vulnerabilities in SolarWinds Serv-U Allow Remote Code Execution
2 rules 3 TTPsMultiple critical vulnerabilities in SolarWinds Serv-U MFT and FTP Server allow remote code execution, potentially leading to system compromise.
Suspicious SolarWinds Child Process Execution
2 rules 2 TTPsDetection of unusual child processes spawned by SolarWinds processes may indicate malicious program execution, potentially bypassing security controls.
SUNBURST Command and Control Activity Detected
2 rules 2 TTPsThis rule detects post-exploitation command and control activity related to the SUNBURST backdoor, which targets SolarWind's Orion software, mimicking the Orion Improvement Program (OIP) protocol for covert communication.
SolarWinds Process Disabling Services via Registry Modification
2 rules 3 TTPsA SolarWinds binary is modifying the start type of a service to be disabled via registry modification, potentially to disable or impair security services.
Suspicious Command Execution via SolarWinds Process
2 rules 3 TTPsThis brief covers the detection of suspicious command execution, specifically Cmd.exe or PowerShell.exe, as child processes of legitimate SolarWinds executables, indicative of potential supply chain compromise and unauthorized command execution on Windows systems.