Serv-U Exploitation CVE-2021-35211 by DEV-0322

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•19

Detects patterns indicative of the exploitation of the Serv-U CVE-2021-35211 vulnerability, specifically looking for the execution of 'whoami' in conjunction with specific file paths related to the Serv-U client. This activity has been associated with the threat group DEV-0322.