マルウェア

脅威に関する情報: SolarStormとSUNBURSTからのお客様保護について

8 min read

Cortex XDR による SolarStorm への対応

Cortex XDR Proをご利用中のお客様は、製品既存のアラートセットを活用して関連アクティビティを検索できます。

Cortex XDR Managed Threat Hunting Serviceでは、現在サービスに加入していないお客様も含め、すべてのXDR Proのお客様が利用できるすべてのデータをスキャンし、調査結果に基づく影響レポートをすべてのXDR Proのお客様に送信しています。

まず、組織が侵害されているかどうかを把握するために、App-IDと既知のSolarWindsドメインを活用し、エンドポイントかネットワークデータのいずれかに基づいて、以下のクエリでSolarWindsのインストールを検索します（本稿に記載したクエリについては、更新済みでコピー&ペーストしやすいGitHubのものも合わせてご利用いただけます）。

dataset = xdr_data|filter arraystring(action_app_id_transitions, ",") contains 
"solarwinds" or dst_action_external_hostname = "api.solarwinds.com"  or 
action_external_hostname = "api.solarwinds.com"| fields agent_hostname, 
action_local_ip|dedup agent_hostname, action_local_ip

dataset = xdr_data|filter arraystring(action_app_id_transitions, ",") contains

"solarwinds" or dst_action_external_hostname = "api.solarwinds.com" or

action_external_hostname = "api.solarwinds.com"| fields agent_hostname,

action_local_ip|dedup agent_hostname, action_local_ip

This shows how to leverage AppID and known SolarWinds domains to search for SolarWinds installations based either on endpoint or network data.

攻撃の被害を受けているかどうかを確認するには、パロアルトネットワークスの次世代ファイアウォールまたはSolarWindsサーバーにインストールされたエージェントがあると仮定した場合、クエリを実行することで既知のIOCをチェックできます。

IP、ドメイン、ハッシュ、ファイル名などの既知のIOCは、Cortex XDRにロードすることができます。Cortex XDR は自動的に後方スキャンを実行し、過去の履歴データに基づいてアラートを生成します。

これを行うには、すべての IOC を含むファイルを1つ作成します。

IOCs for SolarWinds and SolarStorm

Rules、IOCの順にページを移動し、[+ Add IOC] をクリックし、ポップアップ表示で[Upload File]を選択します。

This shows how to add SolarStorm and SolarWinds IOCs to Cortex XDR.

ファイルを追加し、Severity (深刻度)、Reputation (評判)、Reliability (信頼性)、Expiration (有効期限) を割り当て、[Upload] をクリックします。

ロード後、[Backward Scan Status (後方スキャンステータス)] は「保留中」となり、[# of Hits(ヒット数)] には「0」が表示されます。数分ほどでタイムスタンプつきでステータスが [Done(完了)] に変更されます。

なんらかの一致が見つかった場合は[# of Hits]が「0」から変化し、システム上で見つかったIOCごとのヒット数が表示されます。

If any matches were found, you'll see the # of Hits displayed per IOC.

IOCを右クリックして[View Associated Alerts (関連アラートの表示)]を選択すると、アラートページにピボットすることができます。

You can right-click on the IOC and select "View Associated Alerts" to pivot to the alert page, as shown.

Cortex XDRでルール名の横にこのアイコンが表示される場合、これはIOCまたはBehavioral IOCの後方スキャンに基づく履歴による一致であることを意味しています。

Historic matches based on backward scanning on an IOC or Behavioral IOC appear as shown.

アラートを右クリックして分析してドリルダウンすることができます。

逆に、既知の IOC を使用して、 XQL クエリを実行することもできます。これにより、NGFW、Cortex Agent、またはCortex XDR Data Lakeに取り込まれたサードパーティネットワークトラフィック由来のファイル書き込み、モジュールロード、プロセス実行、ネットワークトラフィック、DNSクエリを横断的に調べることができます。

dataset = xdr_data|filter action_file_sha256 in ("32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77", "dab758bf98d9b36fa057a66cd0284737abf89857b73ca89280267ee7caf62f3b", "eb6fab5a2964c5817fb239a7a5079cabca0a00464fb3e07155f28b0a57a2c0ed", "c09040d35630d75dfef0f804f320f8b3d16a481071076918e9b236a321c1ea77", "ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c", "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134", "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6", "a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc", "d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af",
“118189f90da3788362fe85eafa555298423e21ec37f147f3bf88c61d4cd46c51”) or action_module_sha256 in ("32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77", "dab758bf98d9b36fa057a66cd0284737abf89857b73ca89280267ee7caf62f3b", "eb6fab5a2964c5817fb239a7a5079cabca0a00464fb3e07155f28b0a57a2c0ed", "c09040d35630d75dfef0f804f320f8b3d16a481071076918e9b236a321c1ea77", "ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c", "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134", "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6", "a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc", "d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af",
“118189f90da3788362fe85eafa555298423e21ec37f147f3bf88c61d4cd46c51”) or action_process_image_sha256 in ("32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77", "dab758bf98d9b36fa057a66cd0284737abf89857b73ca89280267ee7caf62f3b", "eb6fab5a2964c5817fb239a7a5079cabca0a00464fb3e07155f28b0a57a2c0ed", "c09040d35630d75dfef0f804f320f8b3d16a481071076918e9b236a321c1ea77", "ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c", "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134", "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6", "a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc", "d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af",
“118189f90da3788362fe85eafa555298423e21ec37f147f3bf88c61d4cd46c51”) or dst_action_external_hostname ~= ".*freescanonline.com|.*deftsecurity.com|.*thedoccloud.com|.*websitetheme.com|.*highdatabase.com|.*incomeupdate.com|.*databasegalore.com|.*panhardware.com|.*zupertech.com|.*virtualdataserver.com|.*digitalcollege.org|.*avsvmcloud.com|.*solartrackingsystem.net|.*webcodez.com|.*seobundlekit.com|.*virtualwebdata.com|.*lcomputers.com|.*mobilnweb.com|.*kubecloud.com" or action_external_hostname ~= ".*freescanonline.com|.*deftsecurity.com|.*thedoccloud.com|.*websitetheme.com|.*highdatabase.com|.*incomeupdate.com|.*databasegalore.com|.*panhardware.com|.*zupertech.com|.*virtualdataserver.com|.*digitalcollege.org|.*avsvmcloud.com|.*solartrackingsystem.net|.*webcodez.com|.*seobundlekit.com|.*virtualwebdata.com|.*lcomputers.com|.*mobilnweb.com|.*kubecloud.com" or dns_query_name ~= ".*freescanonline.com|.*deftsecurity.com|.*thedoccloud.com|.*websitetheme.com|.*highdatabase.com|.*incomeupdate.com|.*databasegalore.com|.*panhardware.com|.*zupertech.com|.*virtualdataserver.com|.*digitalcollege.org|.*avsvmcloud.com|.*solartrackingsystem.net|.*webcodez.com|.*seobundlekit.com|.*virtualwebdata.com|.*lcomputers.com|.*mobilnweb.com|.*kubecloud.com"
| fields agent_hostname, causality_actor_process_image_path, actor_process_image_path,action_external_hostname, action_file_path, action_module_path, dst_action_external_hostname, dns_query_name |dedup agent_hostname, causality_actor_process_image_path, 
actor_process_image_path,action_external_hostname, action_file_path, action_module_path, dst_action_external_hostname, dns_query_name

dataset = xdr_data|filter action_file_sha256 in ("32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77", "dab758bf98d9b36fa057a66cd0284737abf89857b73ca89280267ee7caf62f3b", "eb6fab5a2964c5817fb239a7a5079cabca0a00464fb3e07155f28b0a57a2c0ed", "c09040d35630d75dfef0f804f320f8b3d16a481071076918e9b236a321c1ea77", "ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c", "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134", "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6", "a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc", "d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af",

“118189f90da3788362fe85eafa555298423e21ec37f147f3bf88c61d4cd46c51”) or action_module_sha256 in ("32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77", "dab758bf98d9b36fa057a66cd0284737abf89857b73ca89280267ee7caf62f3b", "eb6fab5a2964c5817fb239a7a5079cabca0a00464fb3e07155f28b0a57a2c0ed", "c09040d35630d75dfef0f804f320f8b3d16a481071076918e9b236a321c1ea77", "ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c", "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134", "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6", "a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc", "d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af",

“118189f90da3788362fe85eafa555298423e21ec37f147f3bf88c61d4cd46c51”) or action_process_image_sha256 in ("32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77", "dab758bf98d9b36fa057a66cd0284737abf89857b73ca89280267ee7caf62f3b", "eb6fab5a2964c5817fb239a7a5079cabca0a00464fb3e07155f28b0a57a2c0ed", "c09040d35630d75dfef0f804f320f8b3d16a481071076918e9b236a321c1ea77", "ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c", "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134", "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6", "a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc", "d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af",

| fields agent_hostname, causality_actor_process_image_path, actor_process_image_path,action_external_hostname, action_file_path, action_module_path, dst_action_external_hostname, dns_query_name |dedup agent_hostname, causality_actor_process_image_path,

actor_process_image_path,action_external_hostname, action_file_path, action_module_path, dst_action_external_hostname, dns_query_name

Historic matches based on backward scanning on an IOC or Behavioral IOC appear as shown.
攻撃者は異なるドメインやハッシュを使用している可能性があるため、既知のIOCの検索に加えて、感染したSolarWinds実行ファイルの動作を探すことをお勧めします。

以下のクエリを使用して、疑わしい動作が行われていないことを確認することをお勧めします。

1. SolarWindsバイナリが添付されているアラートやインシデント、またはCobalt Strikeに関連するアラートを確認してください。攻撃者による同フレームワークの使用が確認されています。

Look at alerts and incidents that have any SolarWinds binary attached to them or any alerts related to Cobalt Strike

Look at alerts and incidents that have any SolarWinds binary attached to them or any alerts related to Cobalt Strike, as these attackers have been seen using the framework.

2. 感染したSolarWindsプロセスによってドロップされたバイナリファイルやスクリプトファイルを探します。

dataset = xdr_data|filter event_type = FILE and event_sub_type = FILE_WRITE and
lowercase(actor_process_image_name) = “solarwinds.businesslayerhost*.exe” and
action_file_extension in (“dll”, “exe”, “sys”, “msi”, “scr”, “ocx”, “cmd”, “bat”,
“ps1”, “vba”, “vbs”, “com”, “cpl”, “bin”, “vbe”)| fields
causality_actor_process_image_path, actor_process_image_path, agent_hostname,
action_file_path, action_file_name|dedup causality_actor_process_image_path,
actor_process_image_path, agent_hostname, action_file_name

dataset = xdr_data|filter event_type = FILE and event_sub_type = FILE_WRITE and

lowercase(actor_process_image_name) = “solarwinds.businesslayerhost*.exe” and

action_file_extension in (“dll”, “exe”, “sys”, “msi”, “scr”, “ocx”, “cmd”, “bat”,

“ps1”, “vba”, “vbs”, “com”, “cpl”, “bin”, “vbe”)| fields

causality_actor_process_image_path, actor_process_image_path, agent_hostname,

action_file_path, action_file_name|dedup causality_actor_process_image_path,

actor_process_image_path, agent_hostname, action_file_name

3. 感染したSolarWindsプロセスがSolarWinds以外のドメインにアクセスしている兆候がないか確認します。

dataset = xdr_data|filter event_type = NETWORK  and
lowercase(actor_process_image_name) = "solarwinds.businesslayerhost*.exe" and
action_external_hostname not contains "solarwinds.com" and action_external_hostname
!= "*.local" | fields causality_actor_process_image_path, actor_process_image_path,
agent_hostname, action_remote_ip, action_external_hostname|dedup
causality_actor_process_image_path, actor_process_image_path, agent_hostname, action_remote_ip, action_external_hostname

dataset = xdr_data|filter event_type = NETWORK and

lowercase(actor_process_image_name) = "solarwinds.businesslayerhost*.exe" and

action_external_hostname not contains "solarwinds.com" and action_external_hostname

!= "*.local" | fields causality_actor_process_image_path, actor_process_image_path,

agent_hostname, action_remote_ip, action_external_hostname|dedup

causality_actor_process_image_path, actor_process_image_path, agent_hostname, action_remote_ip, action_external_hostname

Look for signs of the infected SolarWinds process accessing non-SolarWinds domains

4. Windows Management Instrumentationクエリを実行している感染SolarWindsプロセスがないか探します。

dataset = xdr_data|filter event_type = RPC_CALL and
lowercase(actor_process_image_name) = "solarwinds.businesslayerhost*.exe" and
action_rpc_interface_name = "IWbemServices"|fields agent_hostname,
action_rpc_func_str_call_fields

dataset = xdr_data|filter event_type = RPC_CALL and

lowercase(actor_process_image_name) = "solarwinds.businesslayerhost*.exe" and

action_rpc_interface_name = "IWbemServices"|fields agent_hostname,

action_rpc_func_str_call_fields

5. 感染したSolarWindsプロセスがサービスを変更または作成していないか探します。

dataset = xdr_data|filter event_type = REGISTRY and
lowercase(actor_process_image_name) = "solarwinds.businesslayerhost*.exe" and
action_registry_key_name = "HKEY_LOCAL_MACHINE\SYSTEM\*\Services\*" | fields
causality_actor_process_image_path, actor_process_image_path, agent_hostname,
action_registry_key_name, action_registry_value_name, action_registry_data |dedup
causality_actor_process_image_path, actor_process_image_path, agent_hostname,
action_registry_key_name, action_registry_value_name, action_registry_data

dataset = xdr_data|filter event_type = REGISTRY and

lowercase(actor_process_image_name) = "solarwinds.businesslayerhost*.exe" and

action_registry_key_name = "HKEY_LOCAL_MACHINE\SYSTEM\*\Services\*" | fields

causality_actor_process_image_path, actor_process_image_path, agent_hostname,

action_registry_key_name, action_registry_value_name, action_registry_data |dedup

causality_actor_process_image_path, actor_process_image_path, agent_hostname,

action_registry_key_name, action_registry_value_name, action_registry_data

Look for the infected SolarWinds process modifying or creating a service

6. ネットワーク接続を開始したバックドア化された DLLを探し出し、アルゴリズムで生成されたドメイン (DGA) を含む疑わしい接続を探すことができます。

dataset = xdr_data
| filter (event_type = NETWORK or event_type = STORY) and
lowercase(actor_process_image_name) contains "solarwinds.businesslayerhost"
| filter action_external_hostname not contains "solarwinds" and
action_external_hostname not contains ".local"
| fields agent_hostname, agent_id, actor_process_instance_id,
actor_process_image_name, action_external_hostname, dst_action_external_hostname,
dns_query_name
| join (dataset = xdr_data
       | filter event_sub_type = LOAD_IMAGE_MODULE and
                                   action_module_sha256 in
("019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134",
"32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77",
"ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6")
                                   and lowercase(actor_process_image_name) contains
"solarwinds.businesslayerhost"
       | fields agent_hostname, agent_id, actor_process_instance_id,
actor_process_image_name, action_module_sha256, action_module_path) as modules
       modules.actor_process_instance_id = actor_process_instance_id and
modules.agent_id = agent_id
       | fields agent_hostname, agent_id, actor_process_instance_id,
actor_process_image_name, action_module_sha256, action_module_path,
action_external_hostname, dst_action_external_hostname, dns_query_name
       | dedup agent_hostname, agent_id, actor_process_instance_id,
actor_process_image_name, action_module_path, action_external_hostname,
dst_action_external_hostname, dns_query_name

dataset = xdr_data

| filter (event_type = NETWORK or event_type = STORY) and

lowercase(actor_process_image_name) contains "solarwinds.businesslayerhost"

| filter action_external_hostname not contains "solarwinds" and

action_external_hostname not contains ".local"

| fields agent_hostname, agent_id, actor_process_instance_id,

actor_process_image_name, action_external_hostname, dst_action_external_hostname,

dns_query_name

| join (dataset = xdr_data

| filter event_sub_type = LOAD_IMAGE_MODULE and

action_module_sha256 in

("019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134",

"32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77",

"ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6")

and lowercase(actor_process_image_name) contains

"solarwinds.businesslayerhost"

| fields agent_hostname, agent_id, actor_process_instance_id,

actor_process_image_name, action_module_sha256, action_module_path) as modules

modules.actor_process_instance_id = actor_process_instance_id and

modules.agent_id = agent_id

| fields agent_hostname, agent_id, actor_process_instance_id,

actor_process_image_name, action_module_sha256, action_module_path,

action_external_hostname, dst_action_external_hostname, dns_query_name

| dedup agent_hostname, agent_id, actor_process_instance_id,

actor_process_image_name, action_module_path, action_external_hostname,

dst_action_external_hostname, dns_query_name

7. 既知のバックドアの名前付きパイプを元にハンティングします。

dataset = xdr_data
| filter action_file_device_type = 1 and action_file_name != null and
lowercase(actor_process_image_name) contains "solarwinds.businesslayerhost"
| filter action_file_name = "583da945-62af-10e8-4902-a8f205c72b2e"
| fields agent_hostname, actor_process_instance_id, actor_process_image_name,
action_file_name
| dedup actor_process_instance_id, actor_process_image_name, action_file_name

dataset = xdr_data

| filter action_file_device_type = 1 and action_file_name != null and

lowercase(actor_process_image_name) contains "solarwinds.businesslayerhost"

| filter action_file_name = "583da945-62af-10e8-4902-a8f205c72b2e"

| fields agent_hostname, actor_process_instance_id, actor_process_image_name,

action_file_name

| dedup actor_process_instance_id, actor_process_image_name, action_file_name

(IoCについては本稿結論ページを参照)

最新リリースの Cortex XDR 2.6.5 に加わった新機能では、Azure Active Directory (AD) の監査ログを照会することにより、脅威アクターがアクセスを取得後、バックドア経由でクレデンシャルを奪取して以降に行ったアクティビティを検索できるようになりました。弊社の管理者ガイドにしたがってCortex XDRを設定している場合は次のクエリでそれらの活動を検索できます。

1. 作成ないし変更されたAzure ADサービスアカウントを探す:

preset = msft_azure_ad_audit // go over azure ad audit logs
| filter activityDisplayName IN ("Add service principal credentials", "Add service principal")
AND result = "success" // find cases where someone adds SPNs to an account

preset = msft_azure_ad_audit // go over azure ad audit logs

| filter activityDisplayName IN ("Add service principal credentials", "Add service principal")

AND result = "success" // find cases where someone adds SPNs to an account

2. 追加テナントに対するAzure ADアプリケーション共有をハントする:

preset = msft_azure_ad_audit  // go over azure ad audit logs
| filter activityDisplayName = "Update application"
AND operationType="Update"
and result="success"
and modifiedDisplayName = "AvailableToOtherTenants"  // find cases where someone grants permission to access an app from another azure ad tenant

preset = msft_azure_ad_audit // go over azure ad audit logs

| filter activityDisplayName = "Update application"

AND operationType="Update"

and result="success"

and modifiedDisplayName = "AvailableToOtherTenants" // find cases where someone grants permission to access an app from another azure ad tenant

3. Azure ADのカスタムの未検証ドメイン追加をハントする:

preset = msft_azure_ad_audit // go over azure ad audit logs
| filter activityDisplayName = "Add unverified domain" AND result = "success"  // find cases
where someone added a custom domain to the azure ad env

preset = msft_azure_ad_audit // go over azure ad audit logs

| filter activityDisplayName = "Add unverified domain" AND result = "success" // find cases

where someone added a custom domain to the azure ad env

4. 特定ドメインに対するSSO無効化をハントする:

preset = msft_azure_ad_audit // go over azure ad audit logs
| filter activityDisplayName = "Disable Desktop Sso for a specific domain" AND result =
"success" // remove need for SSO on desktop devices

preset = msft_azure_ad_audit // go over azure ad audit logs

| filter activityDisplayName = "Disable Desktop Sso for a specific domain" AND result =

"success" // remove need for SSO on desktop devices

5. 変更されたドメインフェデレーション設定をハントする:

preset = msft_azure_ad_audit // go over azure ad audit logs
| filter activityDisplayName = "Set federation settings on domain"

1 2	preset = msft_azure_ad_audit // go over azure ad audit logs \| filter activityDisplayName = "Set federation settings on domain"

6. サービスプリンシパルにメールパーミッションが追加されたケースをハントする:

preset = msft_azure_ad_audit // go over azure ad audit logs
| filter activityDisplayName IN ("Add app role assignment to service
principal", "Add delegated permission grant", "Add application" ) and
        modifiedPropertyNewValue ~= "(Mail.Read|Mail.ReadWrite)" and
        modifiedPropertyOldValue not contains "Mail.Read" // find
cases where mail read was added as a permission to another account