
title: Serv-U Exploitation CVE-2021-35211 by DEV-0322
author: Florian Roth
date: 2021/07/14
description: Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211
  vulnerability by threat group DEV-0322
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine: '*whoami*'
  SELECTION_3:
    CommandLine:
    - '*./Client/Common/*'
    - '*.\Client\Common\\*'
  SELECTION_4:
    CommandLine: '*C:\Windows\Temp\Serv-U.bat*'
  condition: (SELECTION_1 and ((SELECTION_2 and SELECTION_3) or SELECTION_4))
falsepositives:
- Unlikely
id: 75578840-9526-4b2a-9462-af469a45e767
level: critical
logsource:
  category: process_creation
  product: windows
references:
- https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
status: experimental
tags:
- attack.persistence
- attack.t1136.001
- cve.2021.35211
ruletype: SIGMA
