Procedure examples

During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.

During the SolarWinds Compromise, APT29 extracted files from compromised networks.

During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.

During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.

During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.

During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.

During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.

During the SolarWinds Compromise, APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.

During the SolarWinds Compromise, APT29 renamed software and DLLs with legitimate names to appear benign.

During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.

During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.

During the SolarWinds Compromise, APT29 used `scheduler` and `schtasks` to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.

During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.

During the SolarWinds Compromise, APT29 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.

During the SolarWinds Compromise, APT29 used `cmd.exe` to execute commands on remote machines.

For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.

During the SolarWinds Compromise, APT29 used the `Get-ManagementRoleAssignment` PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.

During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.

During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.

During the SolarWinds Compromise, APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.

During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.

During the SolarWinds Compromise, APT29 removed evidence of email export requests using `Remove-MailboxExportRequest`.

During the SolarWinds Compromise, APT29 used HTTP for C2 and data exfiltration.

During the SolarWinds Compromise, APT29 staged data and files in password-protected archives on a victim's OWA server.

During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.

During the SolarWinds Compromise, APT29 used domain administrators' accounts to help facilitate lateral movement on compromised networks.

During the SolarWinds Compromise, APT29 used compromised local accounts to access victims' networks.

During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.

During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.

During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using `Get-ManagementRoleAssignment`.

During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing `Get-ADUser` and `Get-ADGroupMember`.

During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.

During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.

During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using `Set-CASMailbox`, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.

During the SolarWinds Compromise, APT29 granted `company administrator` privileges to a newly created service principle.

During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the `Set-CASMailbox` command.

During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.

During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using `New-MailboxExportRequest` followed by `Get-MailboxExportRequest`.

For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.

During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.

During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.

During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.

During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.

During the SolarWinds Compromise, APT29 accessed victims' internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.

During the SolarWinds Compromise, APT29 downloaded source code from code repositories.

During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads.

During the SolarWinds Compromise, APT29 used the `Get-AcceptedDomain` PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.

During the SolarWinds Compromise, APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.

During the SolarWinds Compromise, APT29 stole Chrome browser cookies by copying the Chrome profile directories of targeted users.

During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with `rundll32.exe`.