APT actors exploit Zoho ManageEngine ServiceDesk RCE
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
APT groups are actively exploiting CVE-2021-44077, an unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus, to deploy webshells and steal credentials.
CVE-2021-44077 is a critical unauthenticated remote code execution vulnerability in Zoho ManageEngine ServiceDesk Plus affecting all versions up to 11305. The vulnerability allows attackers to upload executable files and webshells via the ServiceDesk REST API, enabling post-exploitation activities including credential theft, lateral movement, and data exfiltration. Zoho released patches on September 16, 2021 (build 11306+), with a subsequent advisory on November 22, 2021 urging immediate patching.
The FBI and CISA assess that advanced persistent threat actors have been actively exploiting this vulnerability since at least late October 2021. Attackers use the initial access to deploy webshells and multiple implants including Godzilla JAR backdoors, NGLite, KDC Sponge, and custom malware. Post-exploitation activity follows a consistent pattern: dumping NTDS.dit and registry hives, harvesting credentials via LSASS, conducting lateral movement with WMI, and exfiltrating data through webshells. Attackers deliberately clean up logs and artifacts to obscure evidence of initial compromise.
Targeted sectors include healthcare, financial services, electronics, and IT consulting. The threat actors demonstrate operational security practices including use of signed Windows binaries, custom symmetric encryption for command and control, and renamed legitimate tools like WinRAR and csvde for reconnaissance and exfiltration.
Mentioned in this report
Detection guidance
ManageEngine ServiceDesk Java Process Spawning Shell or Recon Tools
Detects the ServiceDesk Plus Java service spawning command interpreters or recon/credential utilities, consistent with CVE-2021-44077 exploitation and webshell or implant execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ManageEngine ServiceDesk Java Process Spawning Shell or Recon Tools
description: Detects the ManageEngine ServiceDesk Plus Java service spawning command
shells, WMI, or recon and credential tools. Matches the post-exploitation pattern
after CVE-2021-44077 webshell upload, not specific implant names.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
- attack.execution
- attack.t1047
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \java.exe
ParentCommandLine|contains:
- ServiceDesk
- ManageEngine
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \wmic.exe
- \ntdsutil.exe
- \csvde.exe
- \reg.exe
- \rundll32.exe
- \certutil.exe
- \net.exe
- \net1.exe
condition: selection_parent and selection_child
falsepositives:
- ServiceDesk administrators running custom scripts or batch integrations through
the application
- Legitimate ServiceDesk upgrade or service-restart scripts invoking cmd.exe
level: high
id: ae9dd320-0a14-5519-a339-f83ac09ddf46
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-336a
NTDS.dit or Registry Hive Dumping via Command Line
Detects ntdsutil IFM/snapshot creation or reg save of SAM/SYSTEM/SECURITY hives for credential theft, as seen in post-exploitation of ServiceDesk compromises. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: NTDS.dit or Registry Hive Dumping via Command Line
description: Detects ntdsutil creating IFM or snapshot media, or reg.exe saving SAM/SYSTEM/SECURITY
hives, used to steal domain credentials after initial compromise.
tags:
- attack.credential-access
- attack.t1003.003
- attack.t1003
logsource:
category: process_creation
product: windows
detection:
selection_ntdsutil:
Image|endswith: \ntdsutil.exe
CommandLine|contains:
- ifm
- create full
- snapshot
selection_reg:
Image|endswith: \reg.exe
CommandLine|contains:
- ' save '
- ' export '
CommandLine|contains|all:
- hklm
selection_hive:
CommandLine|contains:
- \sam
- \system
- \security
selection_ntds_copy:
CommandLine|contains: ntds.dit
condition: selection_ntdsutil or (selection_reg and selection_hive) or selection_ntds_copy
falsepositives:
- Authorised backup or AD disaster-recovery procedures run by domain admins
- Security assessment tooling during sanctioned penetration tests
level: high
id: 53065047-76e4-5bcb-b05e-77a48b254def
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-336a
WMI Remote Process Creation for Lateral Movement
Detects wmic.exe launching processes on remote nodes, used for lateral movement in the ServiceDesk post-exploitation chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WMI Remote Process Creation for Lateral Movement
description: Detects wmic.exe with /node and process call create, a lateral movement
pattern used by actors exploiting ManageEngine ServiceDesk.
tags:
- attack.execution
- attack.t1047
- attack.lateral-movement
- attack.t1021.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \wmic.exe
CommandLine|contains|all:
- /node
- process
- call
- create
condition: selection
falsepositives:
- Legacy administrative scripts deploying software to remote hosts via WMIC
- Endpoint management tooling using wmic for remote execution
level: medium
id: df08803c-8cf6-5768-8f31-3712f21a79e7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-336a
3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-336a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs