Anomalous Process Execution from SolarWinds Web Help Desk

Information hacker@Informationhacker

•updated Feb 10, 2026•7•0•45

This rule detects anomalous process executions originating from the SolarWinds Web Help Desk application. It monitors for any child processes spawned by the Web Help Desk application that are not part of a predefined allowlist of expected executables (java.exe, pg_dump.exe, reg.exe, conhost.exe, WerFault.exe) or command lines (mysqldump). This can indicate compromise or misuse of the application to execute arbitrary code.