SolarWinds Web Help Desk Exploitation - MSI from Java

Daniel Jeremiah@daniyyell

•updated Feb 9, 2026•0•13

This rule detects the execution of msiexec.exe with command-line arguments indicating a silent installation (`/q`, `/i`) and the download of an MSI package from a remote HTTP or HTTPS source. The detection specifically looks for this activity when the parent process is cmd.exe, and the grandparent process is java.exe, which is associated with SolarWinds Web Help Desk exploitation (CVE-2025-26399, CVE-2025-40551). This pattern suggests post-exploitation payload delivery via MSI from a compromised Java process.