Vuln: CVE-2021-26857 | Detection.FYI

Microsoft Exchange Server UM Spawning Suspicious Processes

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Tactic: Lateral Movement Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend Data Source: Windows Security Event Logs Data Source: Microsoft Defender XDR Data Source: Sysmon Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Vuln: CVE-2021-26857 ·
Share on:

Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857.

Read More