Detect SolarWinds Serv-U Uncontrolled Resource Consumption (CVE-2026-28318) in Microsoft Sentinel
Detects exploitation of CVE-2026-28318, an uncontrolled resource consumption vulnerability (CWE-400) in SolarWinds Serv-U. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows attackers to exhaust server resources, leading to denial of service conditions. Detection focuses on abnormal connection patterns, resource exhaustion indicators, and anomalous request volumes targeting Serv-U services.
MITRE ATT&CK
- Tactic
- Impact
KQL Detection Query
let threshold_connections = 500;
let threshold_window = 5m;
let servu_ports = dynamic([21, 22, 990, 989, 443, 80]);
union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated >= ago(1h)
| where (
(Type == "DeviceNetworkEvents" and (RemotePort in (servu_ports) or LocalPort in (servu_ports)))
or (Type == "CommonSecurityLog" and DeviceProduct has_any ("Serv-U", "ServU"))
)
| summarize ConnectionCount = count(), DistinctRemoteIPs = dcount(RemoteIP), BytesSent = sum(SentBytes), BytesReceived = sum(ReceivedBytes) by bin(TimeGenerated, threshold_window), DeviceName, LocalPort
| where ConnectionCount > threshold_connections
| extend Severity = case(ConnectionCount > 2000, "Critical", ConnectionCount > 1000, "High", "Medium")
| project TimeGenerated, DeviceName, LocalPort, ConnectionCount, DistinctRemoteIPs, BytesSent, BytesReceived, Severity
| order by ConnectionCount descDetects abnormal connection volume to SolarWinds Serv-U ports indicative of resource exhaustion exploitation. Monitors DeviceNetworkEvents and CommonSecurityLog for connection spikes exceeding threshold within rolling 5-minute windows.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate bulk file transfer operations from authorized clients causing high connection counts
- Scheduled backup jobs that open many simultaneous FTP/SFTP connections
- Load testing or capacity planning activities performed by IT teams
- Network scanners or vulnerability assessment tools run by security teams
Other platforms for CVE-2026-28318
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated FTP Connection Flood to Serv-U (Linux)
Expected signal: Network flow logs showing 600+ connection attempts from the test host to port 21 of the target within a short window; firewall logs recording SYN flood or connection rate spike; Serv-U application logs showing session limit errors or connection refused messages
- Test 2SFTP Connection Exhaustion via Python (Linux/macOS)
Expected signal: Process telemetry showing python3 spawning ~600 concurrent TCP connections to port 22; network visibility tools showing elevated socket counts; target host showing increased memory/thread usage for ServUDaemon.exe
- Test 3FTPS Connection Exhaustion via hping3 (Linux)
Expected signal: Network IDS/IPS alerts for SYN flood to port 990; firewall logs recording high packet rate from test source IP; Serv-U host showing elevated network interrupt handling load; Windows Performance Monitor showing ServUDaemon.exe handle/connection count spike
References (4)
Unlock Pro Content
Get the full detection package for CVE-2026-28318 including response playbook, investigation guide, and atomic red team tests.