SolarWinds Serv-U Uncontrolled Resource Consumption (CVE-2026-28318)

let threshold_connections = 500;
let threshold_window = 5m;
let servu_ports = dynamic([21, 22, 990, 989, 443, 80]);
union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated >= ago(1h)
| where (
    (Type == "DeviceNetworkEvents" and (RemotePort in (servu_ports) or LocalPort in (servu_ports)))
    or (Type == "CommonSecurityLog" and DeviceProduct has_any ("Serv-U", "ServU"))
  )
| summarize ConnectionCount = count(), DistinctRemoteIPs = dcount(RemoteIP), BytesSent = sum(SentBytes), BytesReceived = sum(ReceivedBytes) by bin(TimeGenerated, threshold_window), DeviceName, LocalPort
| where ConnectionCount > threshold_connections
| extend Severity = case(ConnectionCount > 2000, "Critical", ConnectionCount > 1000, "High", "Medium")
| project TimeGenerated, DeviceName, LocalPort, ConnectionCount, DistinctRemoteIPs, BytesSent, BytesReceived, Severity
| order by ConnectionCount desc

index=* (sourcetype="solarwinds:servu" OR sourcetype="ftp" OR sourcetype="network" OR sourcetype="firewall")
| eval dest_port=coalesce(dest_port, dpt, DestinationPort)
| where dest_port IN (21, 22, 990, 989, 443, 80)
| bin _time span=5m
| stats count AS connection_count, dc(src_ip) AS distinct_src_ips, sum(bytes_out) AS total_bytes_out BY _time, dest, dest_port
| where connection_count > 500
| eval severity=case(connection_count > 2000, "critical", connection_count > 1000, "high", connection_count > 500, "medium", true(), "low")
| eval alert_title="CVE-2026-28318 Serv-U Resource Exhaustion Detected"
| table _time, dest, dest_port, connection_count, distinct_src_ips, total_bytes_out, severity, alert_title
| sort -connection_count

sequence by destination.ip, destination.port with maxspan=5m
  [network where destination.port in (21, 22, 990, 989, 443, 80) and
   (process.name like~ "Serv-U*" or destination.port in (21, 990, 989))]
  [network where destination.port in (21, 22, 990, 989, 443, 80)] with runs=500

SELECT
  sourceip,
  destinationip,
  destinationport,
  COUNT(*) AS connection_count,
  SUM("bytessentpacketcount") AS total_bytes,
  MIN(starttime) AS window_start,
  MAX(starttime) AS window_end
FROM events
WHERE
  destinationport IN (21, 22, 990, 989, 443, 80)
  AND (logsourcename ILIKE '%serv-u%' OR logsourcename ILIKE '%solarwinds%' OR destinationport IN (21, 990, 989))
  AND starttime > NOW() - 3600000
GROUP BY
  sourceip,
  destinationip,
  destinationport,
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm', 300000)
HAVING connection_count > 500
ORDER BY connection_count DESC
LAST 60 MINUTES

_sourceCategory=network OR _sourceCategory=firewall OR _sourceCategory=servu
| where dest_port in ("21", "22", "990", "989", "443", "80") OR _sourceName matches /[Ss]erv-?[Uu]/
| timeslice 5m
| count as connection_count by _timeslice, dest_ip, dest_port, src_ip
| where connection_count > 500
| sort by connection_count desc
| fields _timeslice, src_ip, dest_ip, dest_port, connection_count
| if (connection_count > 2000, "critical", if (connection_count > 1000, "high", "medium")) as severity

rule cve_2026_28318_servu_resource_exhaustion {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects CVE-2026-28318 SolarWinds Serv-U uncontrolled resource consumption exploitation"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318"
    mitre_attack_tactic = "TA0040"
    mitre_attack_technique = "T1499.002"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.target.port in (21, 22, 990, 989)
    $e.target.ip = $target_ip
    $e.principal.ip = $src_ip

  match:
    $src_ip, $target_ip over 5m

  condition:
    #e > 500
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkConnectIP6
| RemotePort IN [21, 22, 990, 989]
| stats count(aid) AS connection_count, dc(RemoteAddressIP4) AS unique_targets BY LocalAddressIP4, RemotePort, aid
  OVER last 5 minutes
| where connection_count > 500
| eval severity=if(connection_count > 2000, "CRITICAL", if(connection_count > 1000, "HIGH", "MEDIUM"))
| join aid [
    #event_simpleName=ProcessRollup2
    | fields aid, FileName, CommandLine, ParentBaseFileName
  ]
| table LocalAddressIP4, RemotePort, connection_count, unique_targets, FileName, CommandLine, severity