SolarWinds -CVE-2021-35211

Description

//Check for network connections with SolarWInds IP's based on DeviceNetworkEvents## Query

Query · kql

let IPs = pack_array("98.176.196.89", "68.235.178.32", 
"208.113.35.58","144.34.179.162","97.77.97.58"); 
DeviceNetworkEvents
| where RemotePort == 443
| where Protocol == "Tcp" and ActionType == "ConnectionSuccess"
| where Timestamp > ago(7d) 
| where RemoteIP in(IPs)
Raw source SolarWinds -CVE-2021-35211 · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ff01fb94-9b27-48b9-a304-2e86108b5ca4
name: SolarWinds -CVE-2021-35211
description: |
  //Check for network connections with SolarWInds IP's based on DeviceNetworkEvents## Query
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics:
- Command and control
query: |
  let IPs = pack_array("98.176.196.89", "68.235.178.32", 
  "208.113.35.58","144.34.179.162","97.77.97.58"); 
  DeviceNetworkEvents
  | where RemotePort == 443
  | where Protocol == "Tcp" and ActionType == "ConnectionSuccess"
  | where Timestamp > ago(7d) 
  | where RemoteIP in(IPs)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.