SolarWinds Web Help Desk Exploitation - Zoho RMM and Velociraptor
This rule detects the execution of 'TOOLSIQ.EXE' (Zoho ManageEngine RMM) or 'Velociraptor.exe' when their parent process is either 'java.exe' or 'wrapper.exe'. This specific parent-child process relationship is indicative of post-exploitation activity, particularly in the context of a compromised SolarWinds Web Help Desk host, as described in the rule's context. The rule aims to identify the deployment of remote monitoring and management tools or C2 frameworks following an initial compromise.
Sigma
