Detect CVE-2025-40551 — SolarWinds Web Help Desk Deserialization RCE in Microsoft Sentinel
Detects exploitation of CVE-2025-40551, a deserialization of untrusted data vulnerability in SolarWinds Web Help Desk. Successful exploitation allows unauthenticated or low-privileged attackers to achieve remote code execution on the WHD server. This CVE is listed in CISA KEV, indicating active exploitation in the wild.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
let WHDProcesses = dynamic(["java", "javaw", "tomcat", "whd"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "net.exe", "net1.exe", "whoami.exe", "curl.exe", "wget.exe"]);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated > ago(7d)
| where (InitiatingProcessFileName in~ (WHDProcesses) and FileName in~ (SuspiciousChildren))
or (EventID == 4688 and ParentProcessName has_any (WHDProcesses) and NewProcessName has_any (SuspiciousChildren))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| extend Alert = "Possible CVE-2025-40551 SolarWinds WHD Deserialization RCE - Suspicious Child Process"Detects suspicious child processes spawned from SolarWinds Web Help Desk Java/Tomcat processes, which may indicate successful deserialization exploitation leading to RCE.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrative Java processes spawning cmd.exe for maintenance tasks
- Automated patching or update scripts launched by WHD service account
- Security tooling or EDR agents running under the Tomcat/WHD process tree
- Scheduled diagnostics or health check scripts invoked by the WHD service
Other platforms for CVE-2025-40551
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate WHD Deserialization RCE — Whoami Execution
Expected signal: ProcessCreate event with ParentImage=java.exe and Image=whoami.exe; captured by Sysmon EventID 1 or Defender DeviceProcessEvents
- Test 2Simulate WHD Deserialization RCE — PowerShell Reverse Shell Stub
Expected signal: ProcessCreate with ParentImage=java.exe, Image=powershell.exe, CommandLine containing '-NoProfile'; network telemetry if actual reverse shell payload used
- Test 3Simulate WHD Web Shell Drop via Java Process
Expected signal: FileCreate event for shell.jsp under WHD webapps directory, initiated by java.exe; Sysmon EventID 11 or DeviceFileEvents
- Test 4Simulate WHD Outbound C2 Callback from Java Process (Linux)
Expected signal: Network connection from java or curl process to external IP on non-standard port; captured by auditd, Falco, or network flow telemetry
Unlock Pro Content
Get the full detection package for CVE-2025-40551 including response playbook, investigation guide, and atomic red team tests.