Detection rules › Kusto Query Language
TEARDROP memory-only dropper
Identifies SolarWinds TEARDROP memory-only dropper IOCs in Window's defender Exploit Guard activity References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059 Command and Scripting Interpreter |
| Persistence | T1543 Create or Modify System Process |
| Privilege Escalation | T1543 Create or Modify System Process |
| Defense Evasion | T1027 Obfuscated Files or Information |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Defender-DeviceEvents | 9007000 | Defender event (any) |
Stages and Predicates
Stage 1: source
DeviceEvents
Stage 2: where
ActionType match "ExploitGuardNonMicrosoftSignedBlocked"
Stage 3: where
and
FileName match "NetSetupSvc.dll"
InitiatingProcessFileName match "svchost.exe"
Stage 4: extend
Stage 5: extend
Stage 6: extend
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ActionType | match |
|
FileName | match |
|
InitiatingProcessFileName | match |
|