As an update from our Wednesday, December 9th, 2020 advisory, eSentire is continuing to closely monitor the situation. eSentire has not observed any indicators of compromise associated with the disclosure of FireEye’s Red Team assessment tools being used maliciously. We have detected numerous routine penetration testing instances using these tools and have alerted appropriately. MVS has been updated to include coverage for all CVE targets identified by FireEye (see below) and we recommend that you continue to review your reports and remediate associated vulnerabilities. We will continue to keep you updated if there are any additional updates. We encourage you to watch the recorded webinar that discusses this topic.
THE THREAT:
On December 14th, FireEye disclosed a global supply chain intrusion campaign based on compromised SolarWinds Orion releases. The compromised releases subsequently masqueraded its traffic as the Orion Improvement Protocol, thereby blending in with legitimate SolarWinds activity to obfuscate the threat actors' activities.
FireEye has developed and publicly released approximately 300 countermeasures, aimed at arming the security community at large to defend against the attacks they authored. eSentire has implemented new detection content based on information shared by FireEye. We will continue to monitor the situation and deploy new detection content as necessary.
What we're doing about it:
- Additional esNETWORK rules have been deployed to identify tools executing against customer environments to supplement existing detection coverage
- esENDPOINT file hashes are being periodically queried and checked against Indicators of Compromise provided by FireEye
- esLOG and esENDPOINT rules are being evaluated for new and refined detection opportunities
- MVS customers – Coverage is provided for all CVEs identified by FireEye
- eSentire has recorded a webinar that covers this topic. Watch it here.
What you should do about it:
- Ensure anti-virus signatures are up to date
- MVS customers should review scan reports for the presence of vulnerable systems. These reports can be reviewed by accessing the latest vulnerability reports on the eSentire Insight Portal. MVS Cloud customers can also access reports by accessing their Tenable.io instance or eSentire Insight Portal. Non-MVS customers should review vulnerability scan reports for the presence of vulnerable systems
- Ensure systems are fully up-to-date to mitigate against known exploits
Additional Information:
Prioritized CVEs by FireEye:
CVE-2019-11510 - Pulse Secure SSL VPNs
CVE-2020-1472 - Microsoft Active Directory
CVE-2018-13379 - Fortinet Fortigate SSL VPN
CVE-2018-15961 - Adobe ColdFusion
CVE-2019-0604 - Microsoft SharePoint
CVE-2019-0708 - Windows Remote Desktop Services
CVE-2019-11580 - Atlassian Crowd
CVE-2019-19781 - Citrix Application Delivery Controller and Citrix Gateway
CVE-2020-10189 - ZoHo ManageEngine Desktop Central
CVE-2014-1812 - Windows
CVE-2019-3398 - Confluence
CVE-2020-0688 - Microsoft Exchange
CVE-2016-0167 - Microsoft Windows
CVE-2017-11774 - Microsoft Outlook
CVE-2018-8581 - Microsoft Exchange Server
CVE-2019-8394 - ZoHo ManageEngine ServiceDesk Plus
