Suspicious Serv-U Child Process Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects the creation of suspicious processes (like command interpreters or scripting engines) as child processes of the Serv-U.exe application. This pattern is indicative of potential exploitation of the Serv-U service, possibly through vulnerabilities like CVE-2021-35211, leading to arbitrary command execution.