SolarWinds Attack: Cloud Security Detection and Response Guidance
Summary
Wiz outlines cloud-focused response steps for the SolarWinds campaign, including inventorying deployments, scanning for known indicators and compromised backups, and monitoring privileged identities, federation trusts, and OAuth credentials.
Key points
- The article describes the campaign as spanning on-premises and cloud environments, with attackers extending access to Azure Active Directory, Office 365, and other cloud resources.
- It recommends inventorying cloud SolarWinds deployments and versions, noting that some legacy asset and vulnerability tools have limited cloud coverage.
- For compromise checks, it advises combining endpoint, SIEM, cloud-native, and file-scanning tools to look for known indicators associated with SUNBURST, SUPERNOVA, and stolen FireEye tools.
- The article notes that agentless file scanning can cover cloud workloads and backups but cannot detect memory-only threats; backups should be scanned before restoration.
- It urges teams to investigate privileged identities and monitor for suspicious changes to federation trusts and OAuth application credentials.
- The guidance describes Golden SAML as a way an attacker with access to a signing certificate could create tokens for cloud access, and recommends protecting signing certificates and monitoring relevant identity events.
Article Details
- Defense Focus
- Detect and remove SolarWinds-related backdoor and identity persistence across hybrid on-premises and cloud environments, including dormant access that may remain after initial evidence is removed.
- Detection Methods
- Inventory cloud deployments and versions of SolarWinds across virtual machines and containers.
- Scan cloud compute resources and files for known attack IOCs and signatures associated with SUNBURST, SUPERNOVA, and the stolen FireEye red-team tools.
- Use EDR, network detection, and cloud-native scanning together; the article notes that individual approaches may have gaps in cloud coverage.
- Scan backups and snapshots for compromise before restoring them.
- Monitor suspicious login events, changes to federation providers or trusts, and additions or changes of credentials and permissions in highly privileged OAuth apps.
- Review privileged and unused service accounts, third-party access, and exposed or vulnerable resources with high permissions.
- Data Sources
- Cloud asset inventories and configuration data, including SolarWinds deployments and versions
- File and endpoint scan results, EDR alerts, and known-IOC matches
- Network detection alerts and cloud logs streamed to SIEM systems
- Active Directory and Azure AD authentication events, credentials, and account changes
- Federation provider and trust configuration changes
- OAuth app registrations, credentials, and permissions
- Backup and snapshot contents
- Cloud identity and third-party access analysis
- Rule Types
- Known-IOC and malware-signature matching
- Suspicious-login monitoring
- Federation-provider and trust-change monitoring
- Privileged OAuth app and credential-change monitoring
- Microsoft-recommended event monitoring for Golden SAML detection
- Platforms
- Hybrid on-premises and cloud environments, including virtual machines and containers
- Defensive Actions
- Coordinate cloud security, on-premises security, SOC, and incident-response teams to conduct end-to-end discovery.
- Run a cloud-wide scan to identify SolarWinds deployments, affected versions, known IOCs, and potentially compromised resources.
- Assess the permissions and potential impact of deployed SolarWinds systems, which the article says may hold credentials and cloud API keys.
- Look for both backdoor persistence and identity persistence, and remove identified persistence promptly.
- Monitor and investigate privileged identities, dormant accounts, third-party access, federation changes, and OAuth app credential changes.
- Scan existing backups and snapshots before using them to restore systems.
- To reduce signing-certificate theft risk, the article recommends not storing the on-premises signing certificate; it also describes using a cloud identity service as an alternative.
- Avoid syncing passwords from on-premises where feasible, as recommended in the article.
MITRE ATT&CK
T1078.004 · Cloud AccountsThe article says attackers gained access to dormant, highly privileged accounts for later use and used generated SAML tokens to access cloud resources.T1098.001 · Additional Cloud CredentialsThe article describes attackers adding their own credentials to existing OAuth apps, sometimes also adding permissions to establish a future backdoor.T1484.002 · Trust ModificationThe article describes adding a new federation trust or changing an existing one using attacker-owned certificates.T1606.002 · SAML TokensThe article describes Golden SAML: attackers copy a signing certificate and generate SAML tokens to access cloud resources as users.
Malware
SUNBURSTKaspersky discovers links to a known Russian malware. More info here. CrowdStrike discovers additional malware (SUNSPOT) that injected SUNBURST via CI/CD. More info here.SUNSPOTKaspersky discovers links to a known Russian malware. More info here. CrowdStrike discovers additional malware (SUNSPOT) that injected SUNBURST via CI/CD. More info here.SUPERNOVAPalo Alto Networks discovers a second attack vector leveraging a zero-day authentication bypass exploit in the SolarWinds product codenamed SUPERNOVA, find details here.
Vendors
Amazon Web Servicesused to escalate into Office 365 can be used to access into Azure (Azure AD is a shared resource) and also AWS (most customers have some degree of on-premises trust into AWS).Long term access – In the past, theseCrowdStrikeKaspersky discovers links to a known Russian malware. More info here. CrowdStrike discovers additional malware (SUNSPOT) that injected SUNBURST via CI/CD. More info here.FireEyeWhat seemed to be a targeted attack against FireEye just weeks ago, quickly turned out to be “one of the worst cyber-espionage campaigns ever suffered by the U.S”.MicrosoftMSRC, the Microsoft research team, reports the adversaries also attacked cloud systems. They describe a new attack method, dubbed “Golden SAML”, targeting Office 365 by leveraging SAML tokens generated by the attackers.SolarWindsTheThe Wiz incident response and research teams are ready to assist customers with the SolarWinds attack.WizTheThe Wiz incident response and research teams are ready to assist customers with the SolarWinds attack.
Products
Amazon GuardDutyCloud native network detection tools such as AWS GuardDuty AWS GuardDuty may be able to provide network detections. The vendor didn’t provide any guidance. Not clear. AWS GuardDuty has network detection alerts butAWS InspectorFirst party vulnerability assessment solutions such as AWS Inspector and Azure Security Center. Search for SolarWinds deployments via AWS Inspector, no official guidance published by AWS. Partial coverage. Depends onAzure ADThe attackers leveraged their initial foothold to expand into Azure Active Directory (AD) and Office 365 services, as well as other cloud resources; making this one of the first large-scale cyber campaigns that is trulyAzure Security CenterFirst party vulnerability assessment solutions such as AWS Inspector and Azure Security Center. Search for SolarWinds deployments via AWS Inspector, no official guidance published by AWS. Partial coverage. Depends onMicrosoft Defender ATPEDR tools such as CrowdStrike and Microsoft Defender ATP All major EDR vendors released guidance for SolarWinds, here is the CrowdStrike link. Partial coverage. EDRs depend on agents and suffer from limited coverage inMicrosoft SentinelSIEM solutions such as Splunk, Sumo Logic, Azure Sentinel All major SIEM solutions released guidance for SolarWinds, here is the Splunk link, Azure Sentinel link. Complex & expensive. Streaming cloud logs to SIEMOffice 365Initially the attack seemed to be focused on on-prem networks, but it quickly became clear that the attackers were after Office 365 emails systems and other cloud assets.SolarWinds OrionImpact analysis – one of the key reasons that SolarWinds Orion is such a prime target for attackers is that the network monitoring appliance has the “keys to the kingdom”.WizTheThe Wiz incident response and research teams are ready to assist customers with the SolarWinds attack.