Security research

www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399

https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399

Published on: www.huntress.com

ATT&CK techniques those detections carry

T1219Remote Access Tools
T1218System Binary Proxy Execution
T1219.002Remote Desktop Software
T1059Command and Scripting Interpreter
T1059.001PowerShell
T1059.003Windows Command Shell
T1090Proxy
T1105Ingress Tool Transfer
+3 more

3 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
RMM Software Installation from a Commonly Abused Web Service	Medium	Elastic detection rules	Sep 15, 2026	Elastic License 2.0
Suspicious Shell Execution via Velociraptor	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Potential Traffic Tunneling using QEMU	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0

Showing 3 of 3

Filter in the catalogue