Suspicious Child Process of SolarWinds WebHelpDesk

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious child processes spawned by SolarWinds WebHelpDesk (WHD) application, which may indicate exploitation activity leveraging RCE vulnerabilities such as CVE-2025-40551, CVE-2025-40536, or CVE-2025-26399

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Suspicious Child Process of SolarWinds WebHelpDesk
id: 8c7f4a2d-3b9e-4f1c-9a6d-2e8f5c3d9a1b
status: experimental
description: |
    Detects suspicious child processes spawned by SolarWinds WebHelpDesk (WHD) application, which may indicate exploitation activity leveraging RCE vulnerabilities such as CVE-2025-40551, CVE-2025-40536, or CVE-2025-26399
references:
    - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
    - https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399
    - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
author: Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-02-11
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2025-26399
    - cve.2025-40536
    - cve.2025-40551
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: '\WebHelpDesk\bin\'
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
        ParentCommandLine|contains: 'tomcat'
    selection_suspicious_child:
        CommandLine|contains:
            - '-enc'
            - 'base64'
            - 'bitsadmin'
            - 'certutil'
            - 'curl'
            - 'Invoke-RestMethod'
            - 'Invoke-WebRequest'
            - 'irm '
            - 'iwr '
            - 'mshta'
            - 'msiexec'
            - 'Net.WebClient'
            - 'Start-BitsTransfer'
            - 'wget'
            - 'wmic'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|contains: '\WebHelpDesk\bin\'
    ParentImage|endswith:
        - '\java.exe'
        - '\javaw.exe'
    ParentCommandLine|contains: 'tomcat'

Stage 2: `selection_suspicious_child`

selection_suspicious_child:
    CommandLine|contains:
        - '-enc'
        - 'base64'
        - 'bitsadmin'
        - 'certutil'
        - 'curl'
        - 'Invoke-RestMethod'
        - 'Invoke-WebRequest'
        - 'irm '
        - 'iwr '
        - 'mshta'
        - 'msiexec'
        - 'Net.WebClient'
        - 'Start-BitsTransfer'
        - 'wget'
        - 'wmic'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-enc` corpus 3 (sigma 2, elastic 1) `Invoke-RestMethod` corpus 5 (sigma 5) `Invoke-WebRequest` corpus 15 (sigma 10, elastic 3, chronicle 1, kusto 1) `Net.WebClient` corpus 3 (sigma 2, elastic 1) `Start-BitsTransfer` corpus 5 (sigma 3, elastic 1, splunk 1) `base64` corpus 19 (elastic 12, sigma 7) `bitsadmin` corpus 10 (sigma 10) `certutil` corpus 12 (sigma 10, kusto 2) `curl` corpus 19 (sigma 14, elastic 4, splunk 1) `irm` corpus 5 (sigma 5) `iwr` corpus 13 (sigma 11, chronicle 2) `mshta` corpus 14 (sigma 14) `msiexec` corpus 5 (sigma 5) `wget` corpus 13 (sigma 8, elastic 3, splunk 1, kusto 1) `wmic` corpus 6 (sigma 6)	`field:"CommandLine" kind:match`
`ParentCommandLine`	match	`tomcat` corpus 2 (sigma 2)	`field:"ParentCommandLine" kind:match value:"tomcat"`
`ParentImage`	ends_with	`\java.exe` corpus 8 (sigma 8) `\javaw.exe` corpus 7 (sigma 7)	`field:"ParentImage" kind:ends_with`
`ParentImage`	match	`\WebHelpDesk\bin\`	`field:"ParentImage" kind:match value:"\WebHelpDesk\bin\"`