SolarWinds Serv-U Zero-Day (CVE-2021-35211) Detection

A  critical zero-day bug (CVE-2021-35211), existing in SolarWinds Serv-U Managed File Transfer Server and Serv-U Secured FTP products, has been repeatedly exploited in the wild by a China-baked hacker collective, Microsoft reveals. The flaw provides threat actors with the ability to execute arbitrary code remotely and reach the full system compromise.

CVE-2021-35211 Description

According to SolarWinds advisory, CVE-2021-35211 is a remote code execution issue that affects Serv-U version 15.2.3 HF1 and earlier. Upon successful exploitation, hackers can execute arbitrary code with high privileges to drop malicious software, modify or steal sensitive data, and access confidential information. 

Notably, the exploitation is limited and possible only with SSH enabled in the Serv-U environment. Furthermore, SolarWinds states that this zero-day issue impacts only Serv-U Managed File Transfer and Serv-U Secure FTP. All other SolarWinds or N-able products are considered to be secure. No ties to the SUNBURST supply-chain attack have been observed.

Microsoft reported the issue to SolarWinds in mid-July 2021 after its Threat Intelligence Center (MSTIC) and Offensive Security Research teams discovered a series of highly targeted attacks exploiting the flaw in the wild. The proof-of-concept exploit has been also transferred to the vendor, yet no PoCs are currently available on the web.

According to the detailed inquiry from Microsoft, the bug was leveraged by a China-affiliated group currently tracked as DEV-0322 by MSTIC. This actor has been tied to several operations aimed against the US Defense Industrial Base Sector and several software companies. The activity of this hacker collective is impressively covert. The only details publicly shared by researchers reveal that DEV-0322 relies on commercial VPNs and vulnerable home routers to maintain its infrastructure. 

SolarWinds Serv-U Zero-Day Detection and Mitigation

Immediately after the bug was reported to the vendor, SolarWinds pushed a hotfix for Serv-U version 15.2.3 HF1. Now, the vulnerability is fully patched with the release of version 15.2.3 HF2. Users are urged to upgrade to the latest secure version ASAP, even in case they have SSH disabled on the Serv-U environment.

To detect the malicious activity associated with CVE-2021-35211 and help organizations proactively defend against possible attacks, the SOC Prime Team together with Florian Roth have released a set of Sigma rules. This SOC content is available for free download right from Threat Detection Marketplace via this link: https://tdm.socprime.com/detections/?tagsCustom%5B%5D=ServU 

Threat Actor IOCs which Targeting SolarWinds Serv-U Software with 0-day exploit (CVE-2021-35211) 

This rule, written by the SOC Prime Team, detects IPs used in the exploitation of SolarWinds Serv-U services and has translations to the following language formats:

SIEM & SECURITY ANALYTICS: Azure Sentinel, Chronicle Security, ArcSight, QRadar, Splunk, Sumo Logic, ELK Stack, LogPoint, Humio, RSA NetWitness, FireEye, Apache Kafka ksqlDB, Securonix

MITRE ATT&CK

Tactics: Initial Access

Techniques: Exploit Public-Facing Application  (T1190)

Threat Actor Command Line IOCs Targeting SolarWinds Serv-U Software with 0-day exploit (CVE-2021-35211) 

This rule, also developed by the SOC Prime Team, detects Command Lines used in the flaw exploitation. It has translations to the following language formats: 

SIEM & SECURITY ANALYTICS: Azure Sentinel, Chronicle Security, ArcSight, QRadar, Splunk, Sumo Logic, ELK Stack, LogPoint, Humio, RSA NetWitness, FireEye, Apache Kafka ksqlDB, Securonix

EDR: Carbon Black, CrowdStrike, SentinelOne

MITRE ATT&CK 

Tactics: Initial Access

Techniques: Exploit Public-Facing Application  (T1190)

Serv-U Exploitation CVE-2021-35211 by Dev-0322

This Sigma behavior-based detection from the GitHub repo owned by Florian Roth detects patterns as noticed in the exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322. The translations are available for the following language formats.

SIEM & SECURITY ANALYTICS: Azure Sentinel, Chronicle Security, ArcSight, QRadar, Splunk, Sumo Logic, ELK Stack, LogPoint, Sysmon, Humio, RSA NetWitness, FireEye, Apache Kafka ksqlDB, Securonix

EDR: Carbon Black, CrowdStrike, SentinelOne

MITRE ATT&CK 

Tactics: Persistence

Techniques: Create Account (T1136)

Suspicious Serv-U Process Pattern

This rule, also provided by Florian Roth, detects a suspicious process pattern which could be a sign of an exploited Serv-U service. It has translations to the following language formats:

SIEM & SECURITY ANALYTICS: Azure Sentinel, Chronicle Security, ArcSight, QRadar, Splunk, Sumo Logic, ELK Stack, LogPoint, Sysmon, Humio, RSA NetWitness, FireEye, Apache Kafka ksqlDB, Securonix

EDR: Carbon Black, SentinelOne

Sign up to Threat Detection Marketplace to reach over 100K qualified, cross-vendor, and cross-tool detection rules tailored to 20+ market-leading SIEM, EDR, NTDR, and XDR technologies. Enthusiastic to participate in threat hunting activities and enrich our library with new Sigma rules and contribute to the world’s cybercommunity? Join our Threat Bounty Program for a safer future!

Go to Platform Join Threat Bounty