TTP Table for Detecting APT Activity Related to SolarWinds and Active Directory/M365 Compromise

ronjor · Mar 17, 2021

Original release date: March 17, 2021

CISA has released a table of tactics, techniques, and procedures (TTPs) used by the advanced persistent threat (APT) actor involved with the recent SolarWinds and Active Directory/M365 compromise. The table uses the MITRE ATT&CK framework to identify APT TTPs and includes detection recommendations. This information will assist network defenders in detecting and responding to this activity.
Click to expand...

CISA encourages network defenders to review SolarWinds and AD/M365 Compromise: Detecting APT Activity from Known TTPs and implement the recommendations. CISA also recommends network defenders review the following resources regarding this incident:
Click to expand...

ronjor · May 14, 2021

CISA Publishes Eviction Guidance for Networks Affected by SolarWinds and AD/M365 Compromise

Original release date: May 14, 2021
CISA has released an analysis report, AR21-134A Eviction Guidance for Networks Affected by the SolarWinds and Active Directory/M365 Compromise. The report provides detailed steps for affected organizations to evict the adversary from compromised on-premises and cloud environments.
Click to expand...

Log in or Sign up

TTP Table for Detecting APT Activity Related to SolarWinds and Active Directory/M365 Compromise

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

TTP Table for Detecting APT Activity Related to SolarWinds and Active Directory/M365 Compromise

ronjor Global Moderator

ronjor Global Moderator

Useful Searches