Hello, welcome to the Thursday, December 17th, 2020 edition of the Santernet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

If you follow it, then you probably can't avoid the solar winds compromise, one of the critical, in the case of compromise that often has been mentioned is DNS queries.

One of the first thing the backdoor does when it's deployed is to reach out to a host within the ABSvMCloud.com domain. So first thing to do for you as a defender and

a threat hunter, of course, is to check your DNS logs for queries for this domain. Well, it turns out

if your infrastructure is mostly cloud-based. This may be a difficult undertaking.

And in today's diaries, Danielle is going over some of the options that you have available

here in Asia and in AWS. And, well, some of these features actually have just recently

become available, so unlikely that you will have DNS logs going back

to March, which is what you really need in this particular case.

Talking about Solar Winds and this AVSvvMCloud.com domain turns out that Fire Eye apparently

has taken possession of this particular domain name.

This should put an end to any additional spread of the malware because the first thing that

the malware apparently does is download additional code from a host name within that domain.

Fire Eye is pointing the host names

now to addresses within Microsoft's IP address space GoDaddy is the registrar at this point.

So if you do name resolutions of these host names today, you will end up with Microsoft IP addresses.

You should still look for DNS queries and outbound traffic for this particular domain name,

so that's still a good indicator, but don't be surprised if the connection then points to a Microsoft IP address.

In German Computer Magazine, Hisey has an interesting article related to Solar Winds, pointing

to a now no longer public support document published by SolarWinds back in 2018, requesting that customers exempt any

solar winds related directories from antivirus scans. This is very common and usually bad

advice where a vendor feels that antivirus may impact performance of their product and requests that

...