Suspicious Child Process Spawned by SolarWinds Process

This detection rule identifies suspicious command execution originating from SolarWinds processes. Adversaries may leverage compromised SolarWinds installations to execute arbitrary commands, often using cmd.exe or powershell.exe to perform malicious actions. The rule focuses on detecting instances where these command interpreters are spawned as child processes of specific SolarWinds executables, indicating potential misuse. This activity is associated with supply chain compromise attacks, similar to the SUNBURST campaign which impacted SolarWinds Orion Platform. Detecting this pattern can help identify and respond to potential compromises within SolarWinds environments. The rule is designed to detect post-compromise activity rather than the initial entry vector.

Attack Chain

1. The attacker gains initial access via a supply chain compromise, such as the SUNBURST backdoor in SolarWinds Orion.
2. The compromised SolarWinds process executes commands on the system.
3. The SolarWinds process spawns a child process, either cmd.exe or powershell.exe.
4. The attacker uses cmd.exe or powershell.exe to perform reconnaissance.
5. The attacker uses cmd.exe or powershell.exe to move laterally within the network.
6. The attacker uses cmd.exe or powershell.exe to exfiltrate sensitive data.
7. The attacker may attempt to establish persistence on the system.
8. The final objective is data theft, system compromise, or further exploitation of the network.

Impact

A successful attack can result in widespread compromise of systems within the SolarWinds environment, potentially affecting thousands of organizations. The SUNBURST attack, for example, compromised numerous government agencies and private companies. Impacts include data theft, system disruption, and the potential for further attacks on connected networks. The severity of the impact depends on the extent of the attacker's access and the sensitivity of the data they can access.

Recommendation

• Deploy the Sigma rule SolarWinds Process Spawning Command Interpreter to your SIEM to detect suspicious command execution.
• Enable process creation logging with command line arguments to provide visibility for the Sigma rule to function correctly.
• Investigate any alerts generated by this rule, focusing on the command-line arguments used by the spawned processes.
• Review SolarWinds configurations for any unauthorized changes or modifications.
• Implement application whitelisting to prevent unauthorized execution of command-line interpreters from SolarWinds processes as mentioned in the overview.
• Refer to the references in this brief for more information on the SUNBURST attack and mitigation strategies.