We are continuously the data disclosed by FireEye on the "Sunburst"/UNC2452 operation and working with customers to ensure their protection, detect and mitigate this issue.
All published and subsequent discovered IOCs were immediately added to our FortiGuard threat intelligence network will be leveraged by solutions including FortiGate, FortiAnalyzer, FortiEDR, FortiSandBox, FortiSIEM and FortiClient. As new IOCs are uncovered, they will also be immediately added to our databases.
The latest research on this attack is summarized in this blog https://www.fortinet.com/blog/threat-research/what-we-have-learned-so-far-about-the-sunburst-solarwi...
FortiEDR customers were natively protected from this attack on any system running FortiEDR no change or upgrade is required. And here are the best practices:
- Make sure to set post-execution policies to blocking mode. This will allow you to block malicious behavior even if the system is already compromised through a trusted source, such as this supply chain attack.
- Apply contextual pre-canned policies that can enable proactive actions in case of malicious or inconclusive activities. In this case, these actions would have removed the associated DLL file.
- If you subscribe to the MDR service or were not in protection mode at the time of the attack, please work with the MDR team to assist you with proactive threat hunting.
If you don't have FortiEDR, you can engage with your account team and leverage our Free POC program to detect if you have a backdoor associated with SolarWinds and ensure your on-going security.
------------------------------
Tsailing Merrem
------------------------------
Tsailing Merrem
