CISA releases new SolarWinds malicious activity detection tool

The Cybersecurity and Infrastructure Security Agency (CISA) has released a new tool to detect post-compromise malicious activity associated with the SolarWinds hackers in on-premises enterprise environments.

CISA Hunt and Incident Response Program (CHIRP), the new forensics collection tool, is a Python-based tool that helps detect SolarWinds malicious activity IOCs on Windows operating systems.

"Similar to Sparrow—which scans for signs of APT compromise within an M365 or Azure environment—CHIRP scans for signs of APT compromise within an on-premises environment," CISA explained.

"In this release, CHIRP, by default, searches for IOCs associated with malicious activity detailed in AA20-352A and AA21-008A that has spilled into an on-premises enterprise environment."

The two alerts refer to the SolarWinds hackers' compromise of government agencies, critical infrastructure, and private sector organizations using trojanized SolarWinds Orion products and compromised apps the victims' Microsoft 365 (M365)/Azure environment as initial access vectors.

How CHIRP works

When performing the scan, CHIRP outputs JSON formatted data for further analysis in a SIEM or similar tools. CISA advises organizations to use CHIRP to analyze their environment when they want to:

• Examine Windows event logs for artifacts associated with this activity;
• Examine Windows Registry for evidence of intrusion;
• Query Windows network artifacts; and
• Apply YARA rules to detect malware, backdoors, or implants.

Enterprise admins can use CHIP to look for:

• The presence of malware identified by security researchers as TEARDROP and RAINDROP;
• Credential dumping certificate pulls;
• Certain persistence mechanisms identified as associated with this campaign;
• System, network, and M365 enumeration; and
• Known observable indicators of lateral movement.

Previously released malicious activity detection tools

CISA previously released a PowerShell-based tool dubbed Sparrow that helps detect potentially compromised apps and accounts in Azure/Microsoft 365 environments.

Cybersecurity firm CrowdStrike released a similar detection tool named the CrowdStrike Reporting Tool for Azure (CRT) and designed to help admins analyze Azure environments.

FireEye also published a free tool dubbed Azure AD Investigator that helps organizations discover artifacts indicating malicious activity by the state-backed threat actor behind the SolarWinds supply-chain attack.

The tools were shared after Microsoft disclosed how stolen credentials and access tokens were actively used by threat actors to target Azure customers.

The SolarWinds hackers are tracked as UNC2452 (FireEye), StellarParticle (CrowdStrike), SolarStorm (Palo Alto Unit 42), Dark Halo (Volexity), and Nobelium (Microsoft).

While their identity remains unknown, a joint statement issued by the FBI, CISA, ODNI, and the NSA says that the APT group behind the SolarWinds attack is likely a Russian-backed hacking group.