CVE-2025-40551 — SolarWinds Web Help Desk Deserialization RCE

let WHDProcesses = dynamic(["java", "javaw", "tomcat", "whd"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "net.exe", "net1.exe", "whoami.exe", "curl.exe", "wget.exe"]);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated > ago(7d)
| where (InitiatingProcessFileName in~ (WHDProcesses) and FileName in~ (SuspiciousChildren))
   or (EventID == 4688 and ParentProcessName has_any (WHDProcesses) and NewProcessName has_any (SuspiciousChildren))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| extend Alert = "Possible CVE-2025-40551 SolarWinds WHD Deserialization RCE - Suspicious Child Process"

index=* (source="WinEventLog:Security" EventCode=4688 OR source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
| where (ParentImage LIKE "%java%" OR ParentImage LIKE "%tomcat%" OR ParentImage LIKE "%whd%")
  AND (Image LIKE "%cmd.exe" OR Image LIKE "%powershell.exe" OR Image LIKE "%wscript.exe" OR Image LIKE "%cscript.exe" OR Image LIKE "%mshta.exe" OR Image LIKE "%certutil.exe" OR Image LIKE "%bitsadmin.exe" OR Image LIKE "%whoami.exe" OR Image LIKE "%curl.exe" OR Image LIKE "%wget.exe")
| eval alert="CVE-2025-40551 WHD Deserialization RCE Suspected"
| table _time, host, user, ParentImage, ParentCommandLine, Image, CommandLine, alert
| sort - _time

sequence by host.name with maxspan=30s
  [process where process.name : ("java", "javaw", "tomcat*") and event.type == "start"]
  [process where process.parent.name : ("java", "javaw", "tomcat*") and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "whoami.exe", "curl.exe", "wget.exe", "net.exe") and event.type == "start"]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "ParentProcessName", "ProcessName", "CommandLine", LOGSOURCENAME(logsourceid) AS LogSource
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND ("ParentProcessName" ILIKE '%java%' OR "ParentProcessName" ILIKE '%tomcat%' OR "ParentProcessName" ILIKE '%whd%')
  AND ("ProcessName" ILIKE '%cmd.exe%' OR "ProcessName" ILIKE '%powershell.exe%' OR "ProcessName" ILIKE '%wscript.exe%' OR "ProcessName" ILIKE '%certutil.exe%' OR "ProcessName" ILIKE '%mshta.exe%' OR "ProcessName" ILIKE '%whoami.exe%' OR "ProcessName" ILIKE '%curl.exe%')
  AND LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=windows/events OR _sourceCategory=sysmon
| where (ParentImage matches "*java*" or ParentImage matches "*tomcat*" or ParentImage matches "*whd*")
  and (Image matches "*cmd.exe*" or Image matches "*powershell.exe*" or Image matches "*wscript.exe*" or Image matches "*certutil.exe*" or Image matches "*whoami.exe*" or Image matches "*curl.exe*" or Image matches "*mshta.exe*")
| fields _messageTime, _sourceHost, user, ParentImage, ParentCommandLine, Image, CommandLine
| sort by _messageTime desc

rule cve_2025_40551_whd_deserialization_rce {
  meta:
    author = "df00tech"
    description = "Detects potential CVE-2025-40551 SolarWinds Web Help Desk deserialization RCE via suspicious child processes"
    severity = "CRITICAL"
    reference = "https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551"
  events:
    $parent.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($parent.principal.process.file.full_path, `(?i)(java|javaw|tomcat|whd)`) nocase
    re.regex($parent.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe|whoami\.exe|curl\.exe|wget\.exe)`) nocase
  condition:
    $parent
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName in ("java.exe", "javaw.exe", "tomcat*.exe")
| ImageFileName in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe", "curl.exe", "wget.exe")
| select timestamp, aid, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, ImageFileName, CommandLine
| sort timestamp desc