-
Suspicious SolarWinds Web Help Desk Java Module Load or Child Process
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Use Case: Vulnerability Data Source: Elastic Defend Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Living off the Land Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Vuln: CVE-2025-40536 Vuln: CVE-2025-40551 ·Identifies the SolarWinds Web Help Desk Java process loading an untrusted or remote native module (DLL) or spawning a suspicious child process such as cmd, PowerShell, or rundll32. This behavior is uncommon for the Web Help Desk server and may indicate successful exploitation of deserialization vulnerabilities (CVE-2025-40536, CVE-2025-40551), which allow attackers to load malicious SQLite extensions and achieve remote code execution.
Read More