Emerging Threatcriticaltest

CVE-2020-10148 SolarWinds Orion API Auth Bypass

Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Bhabesh Raj, Tim SheltonCreated Sun Dec 27Updated Mon Jan 025a35116f-43bc-4901-b62d-ef131f42a9af2020

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection:
        cs-uri-query|contains:
            - '/WebResource.axd'
            - '/ScriptResource.axd'
            - '/i18n.ashx'
            - '/Skipi18n'
    selection2:
        cs-uri-query|contains:
            - '/SolarWinds/'
            - '/api/'
    valid_request_1:
        cs-uri-query|contains: 'Orion/Skipi18n/Profiler/'
    valid_request_2:
        cs-uri-query|contains:
            - 'css.i18n.ashx'
            - 'js.i18n.ashx'
    condition: all of selection* and not 1 of valid_request_*