
title: Suspicious Serv-U Process Pattern
author: Florian Roth
date: 2021/07/14
description: Detects a suspicious process pattern which could be a sign of an exploited
  Serv-U service
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    ParentImage: '*\Serv-U.exe'
  SELECTION_3:
    Image:
    - '*\cmd.exe'
    - '*\powershell.exe'
    - '*\wscript.exe'
    - '*\cscript.exe'
    - '*\sh.exe'
    - '*\bash.exe'
    - '*\schtasks.exe'
    - '*\regsvr32.exe'
    - '*\wmic.exe'
    - '*\mshta.exe'
    - '*\rundll32.exe'
    - '*\msiexec.exe'
    - '*\forfiles.exe'
    - '*\scriptrunner.exe'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Legitimate uses in which users or programs use the SSH service of Serv-U for remote
  command execution
id: 58f4ea09-0fc2-4520-ba18-b85c540b0eaf
level: critical
logsource:
  category: process_creation
  product: windows
references:
- https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
status: experimental
tags:
- attack.credential_access
- attack.t1555
- cve.2021.35211
ruletype: SIGMA
