SolarWinds Web Help Desk Post-Exploitation Process Anomaly

Ethan Andrews@eandrews

•updated Feb 9, 2026•1•0•19

Detects the SolarWinds Web Help Desk service process (java.exe or wrapper.exe) spawning shell processes or the MSI installer to download and execute remote payloads. This behavior is a key indicator of post-exploitation activity related to CVE-2025-26399.