SolarWinds WebHelpDesk Post-Exploitation Activity
This query detects multiple patterns of post-exploitation activity related to SolarWinds WebHelpDesk (WHD) vulnerabilities. It first identifies devices where suspicious commands are executed from the WHD directory, and then retrieves all related suspicious activities from those devices. The detection logic includes identifying suspicious child processes spawned by the WHD java service, suspicious command execution from the WHD directory, and suspicious child processes of ToolsIQ.exe, a component known to be abused in WHD exploits.
Microsoft Sentinel (KQL)
