SolarWinds Inventory (Normalized Process Events)

Description

'Beyond your internal software management systems, it is possible you may not have visibility into your entire footprint of SolarWinds installations. This is intended to help use process exection information to discovery any systems that have SolarWinds processes'

Query · kql

imProcessCreate
| where Process has 'solarwinds' 
| extend MachineName = DvcHostname , Process = TargetProcessName
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), MachineCount = dcount(Dvc), AccountCount = dcount(User), MachineNames = make_set(Dvc, 200),
Accounts = make_set(User, 200) by Process, EventVendor, EventProduct
Raw source SolarWinds Inventory (Normalized Process Events) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c3f1606e-48eb-464e-a60c-d53af5a5796e
name: SolarWinds Inventory (Normalized Process Events)
description: |
  'Beyond your internal software management systems, it is possible you may not have visibility into your entire footprint of SolarWinds installations.  This is intended to help use process exection information to discovery any systems that have SolarWinds processes'
requiredDataConnectors: []
tactics:
  - Execution
relevantTechniques:
  - T1072
tags:
  - Solorigate
  - NOBELIUM
query: |
  imProcessCreate
  | where Process has 'solarwinds' 
  | extend MachineName = DvcHostname , Process = TargetProcessName
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), MachineCount = dcount(Dvc), AccountCount = dcount(User), MachineNames = make_set(Dvc, 200),
  Accounts = make_set(User, 200) by Process, EventVendor, EventProduct
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.