Suspicious Process Execution from SolarWinds Web Help Desk

Akshay Gaikwad@AkshayGaikwwad

•updated Feb 10, 2026•4•1•85

Detects suspicious child processes spawned by the SolarWinds Web Help Desk (WHD) service. This behavior was observed during the active exploitation of vulnerable WHD instances as reported by Microsoft.