mohammed taha
@lazylooop0 followers0 downloads6 copies0 likes86 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
This query detects multiple patterns of post-exploitation activity related to SolarWinds WebHelpDesk (WHD) vulnerabilities. It first identifies devices where suspicious commands are executed from the WHD directory, and then retrieves all related suspicious activities from those devices. The detection logic includes identifying suspicious child processes spawned by the WHD java service, suspicious command execution from the WHD directory, and suspicious child processes of ToolsIQ.exe, a component known to be abused in WHD exploits.
