SolarWinds

Indicators of Compromise

Notes

<h3>Exchange Management Shell Powershell cmdlets</h3><p><br></p><p> </p><p> </p><pre>Get-AcceptedDomain Get-CASMailbox Get-Mailbox Get-ManagementRoleAssignment Get-OrganizationConfig Get-OwaVirtualDirectory Get-Process Get-WebServicesVirtualDirectory New-MailboxExportRequest Remove-MailboxExportRequest Set-CASMailbox</pre>

Mitigation

<p>Look for traffic to any of the related malicious domains identified in Notes Section. </p><p><br></p><p>Follow the advice from SolarWinds in their response to this incident. Use the signatures provided by FireEye to identify related activity. </p><p><br></p><p>Ensure that all secret keys associated with MFA or other sensitive integrations are reset following a breach. </p><p><br></p><p>Make sure all credentials in an organization, including service accounts, are reset following a breach and that default passwords or those similar to previous passwords are not used. </p><p><br></p><p>If you run an on-premise Exchange environment, consider adding alerting mechanisms to any EDR solutions for processes using the Exchange Management Shell PowerShell cmdlets listed in IOCs. This may or may not be a valid detection approach depending on how frequently this is used within your organization. More generally, if the Exchange Management Shell is rarely used in a legitimate Administrative context, it may be worth investigating any historical use of this shell.</p>