Ensuring customers are protected from Solorigate

AWS · December 15, 2020

Microsoft is monitoring a dynamic threat environment surrounding the discovery of a sophisticated attack that included compromised binaries from a legitimate software. These binaries, which are related to the SolarWinds Orion Platform, could be used by attackers to remotely access devices. On Sunday, December 13, Microsoft released detections that alerted customers to the presence of these malicious binaries, with the recommendation to isolate and investigate the devices.

It is important to understand that these binaries represent a significant threat to customer environments. Customers should consider any device with the binary as compromised and should already be investigating devices with this alert. Starting on Wednesday, December 16 at 8:00 AM PST, Microsoft Defender Antivirus will begin blocking the known malicious SolarWinds binaries. This will quarantine the binary even if the process is running. We also realize this is a server product running in customer environments, so it may not be simple to remove the product from service. Nevertheless, Microsoft continues to recommend that customers isolate and investigate these devices:

Immediately isolate the affected device. If malicious code has been launched, it is likely that the device is under complete attacker control.
Identify the accounts that have been used on the affected device and consider these accounts compromised. Reset passwords or decommission the accounts.
Investigate how the affected endpoint might have been compromised.
Investigate the device timeline for indications of lateral movement activities using one of the compromised accounts. Check for additional tools that attackers might have dropped to enable credential access, lateral movement, and other attack activities.

If service interruption is not possible, customers must take the action below to exclude SolarWinds binaries. This should be a temporary change that you should revert as soon as you update binaries from the provider or complete your investigation.

For Microsoft Defender Antivirus via GPO Instructions:

PATH:

Computer Configuration

>

Administrative Templates

>

Windows Components

>

Microsoft Defender Antivirus

(or Windows Defender Antivirus) >

Threats

>

Specify threat alert levels at which default action should not be taken when detected

.

Value name:

2147771206

Value:

6

For SCEP via GPO instructions:

PATH:

Computer Configuration

>

Administrative Templates

>

Windows Components

>

Endpoint Protection

>

Threats

>

Specify threat alert levels at which default action should not be taken when detected

.

Value name:

2147771206

Value:

6

Note: If you don’t see the “Endpoint Protection” section, see:

Manage Endpoint Protection using Group Policies – Configuration Manager | Microsoft Docs

For Microsoft Defender Antivirus and SCEP via SCCM Instructions:

PATH:

Assets and Compliance, Endpoint Protection

>

Antimalware Policies

>

Threat overrides

>

Enter Threat name

:

Trojan:MSIL/Solorigate.BR!dha

PATH:

Assets and Compliance, Endpoint Protection

>

Antimalware Policies

>

Override action

:

Allow

For MDAV via MEM using PowerShell Instructions:

Create a PowerShell script with the following content:

Set-MpPreference -ThreatIDDefaultAction_Ids 2147771206 -ThreatIDDefaultAction_Actions 6

Name the script as follows: Allow_SolarWinds.ps1
Save it to a temporary location, such as C:\Temp.
Go to Microsoft Endpoint Manager admin center and sign in.
Browse to Devices > Windows > PowerShell scripts.
Select +Add, and then specify the following settings:

Name:

Allow SolarWinds temporarily

Description:

Allow SolarWinds temporarily while patching

Select Next, and then browse to where you saved the PowerShell script (for example, C:\Temp\Allow_SolarWinds.ps1).
Run the script using the following settings:

Run this script using the logged on credentials:

No

Enforce script signature check:

No

Run script in 64-bit PowerShell Host:

Yes

Select Next.
For Scope tag, use .
Select Next.
For assignment, choose Select groups to include, and then select the security group that has your Windows 10 devices.
Choose Select, and then choose Next.
Review your settings, and then select Add.

Note: For MEM (Intune) PowerShell script troubleshooting, review:

C:\ProgramData\Microsoft Intune Management Extension\Logs\IntuneManagementExtension.log

For manual Microsoft Defender Antivirus via PowerShell Instructions:

Launch PowerShell as Admin

Set-MpPreference -ThreatIDDefaultAction_Ids 2147771206 -ThreatIDDefaultAction_Actions 6

For manual SCEP via PowerShell Instructions:

Launch PowerShell as Admin

Import-Module “$env:ProgramFiles\Microsoft Security Client\MpProvider\MpProvider.psd1”

Set-MProtPreference -ThreatIDDefaultAction_Ids 2147771206 -ThreatIDDefaultAction_Actions 6

Note for Microsoft Defender Antivirus in passive mode:

If EDR in block mode is enabled and Microsoft Defender AV is in passive mode with third-party antivirus product, Microsoft Defender Antivirus will take action if not excluded per instructions provided
If EDR in block mode is not enabled and Microsoft Defender Antivirus is in passive mode with third-party antivirus product, Microsoft Defender Antivirus will alert but no remediation action will take place.

Microsoft has been communicating with SolarWinds regarding this incident. SolarWinds has released updates to help customers mitigate this issue and has provided further customer recommendations and updated binaries for their product. More information is available at Security Advisory | SolarWinds.

For more information and guidance from Microsoft, read:

The post Ensuring customers are protected from Solorigate appeared first on Microsoft Security.