Suspicious Child Process of SolarWinds WebHelpDesk

 1title: Suspicious Child Process of SolarWinds WebHelpDesk
 2id: 8c7f4a2d-3b9e-4f1c-9a6d-2e8f5c3d9a1b
 3status: experimental
 4description: |
 5        Detects suspicious child processes spawned by SolarWinds WebHelpDesk (WHD) application, which may indicate exploitation activity leveraging RCE vulnerabilities such as CVE-2025-40551, CVE-2025-40536, or CVE-2025-26399
 6references:
 7    - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
 8    - https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399
 9    - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
10author: Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems)
11date: 2026-02-11
12tags:
13    - attack.initial-access
14    - attack.t1190
15    - cve.2025-26399
16    - cve.2025-40536
17    - cve.2025-40551
18    - detection.emerging-threats
19logsource:
20    category: process_creation
21    product: windows
22detection:
23    selection_parent:
24        ParentImage|contains: '\WebHelpDesk\bin\'
25        ParentImage|endswith:
26            - '\java.exe'
27            - '\javaw.exe'
28        ParentCommandLine|contains: 'tomcat'
29    selection_suspicious_child:
30        CommandLine|contains:
31            - '-enc'
32            - 'base64'
33            - 'bitsadmin'
34            - 'certutil'
35            - 'curl'
36            - 'Invoke-RestMethod'
37            - 'Invoke-WebRequest'
38            - 'irm '
39            - 'iwr '
40            - 'mshta'
41            - 'msiexec'
42            - 'Net.WebClient'
43            - 'Start-BitsTransfer'
44            - 'wget'
45            - 'wmic'
46    condition: all of selection_*
47falsepositives:
48    - Unknown
49level: high

References

• Analysis of active exploitation of SolarWinds Web Help Desk | Microsoft Security Blog

  

  We are seeing exploitation of SolarWinds Web Help Desk via CVE‑2025‑40551 and CVE‑2025‑40536 that can lead to domain compromise; here is how to patch, hunt, and mitigate now.

  
  Read More

• Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399) | Huntress

  

  Huntress has observed active exploitation of a deserialization and remote code execution against the SolarWinds Web Help Desk software (CVE-2025-26399).

  
  Read More

• WHD 2026.1 release notes

  WHD 2026.1 release notes Formatting and layout changes Tracks formatting/layout/content changes to the release notes builder template Release date: January 28, 2026 Last updated: February 10, 2026 ...

  
  Read More

Related rules

• Linux Suspicious Child Process from Node.js - React2Shell
• Windows Suspicious Child Process from Node.js - React2Shell
• CVE-2020-0688 Exchange Exploitation via Web Log
• CVE-2020-5902 F5 BIG-IP Exploitation Attempt
• CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit