{"id":"58f4ea09-0fc2-4520-ba18-b85c540b0eaf","title":"Suspicious Serv-U Process Pattern","description":"Detects a suspicious process pattern which could be a sign of an exploited Serv-U service","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-07-14","modified":"2022-07-14","tags":["attack.credential-access","attack.t1555","cve.2021-35211"],"technique_ids":["T1555"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution"],"references":["https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/"],"source_path":"rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml","source_sha256":"8edee94416b267656e8a9575b219129aeb073d1756a283f1b39a91125e7547d1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Serv-U Process Pattern\nid: 58f4ea09-0fc2-4520-ba18-b85c540b0eaf\nstatus: test\ndescription: Detects a suspicious process pattern which could be a sign of an exploited Serv-U service\nreferences:\n    - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-07-14\nmodified: 2022-07-14\ntags:\n    - attack.credential-access\n    - attack.t1555\n    - cve.2021-35211\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\Serv-U.exe'\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\sh.exe'\n            - '\\bash.exe'\n            - '\\schtasks.exe'\n            - '\\regsvr32.exe'\n            - '\\wmic.exe'  # https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/\n            - '\\mshta.exe'\n            - '\\rundll32.exe'\n            - '\\msiexec.exe'\n            - '\\forfiles.exe'\n            - '\\scriptrunner.exe'\n    condition: selection\nfalsepositives:\n    - Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1555","id":"T1555","name":"Credentials from Password Stores","page":"techniques/enterprise/T1555/"}],"data_path":"data/detection-rules/58f4ea09-0fc2-4520-ba18-b85c540b0eaf.json","kind":"sigma"}