Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/SolarWinds -CVE-2021-35211

Created July 14, 2021 07:42
Show Gist options
  • Save Shivammalaviya/43d041042f5271a2b41452047104f2b9 to your computer and use it in GitHub Desktop.
Save Shivammalaviya/43d041042f5271a2b41452047104f2b9 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
SolarWinds -CVE-2021-35211
//Check for network connections with SolarWInds IP's based on DeviceNetworkEvents
let IPs = pack_array("98.176.196.89", "68.235.178.32",
"208.113.35.58","144.34.179.162","97.77.97.58");
DeviceNetworkEvents
| where RemotePort == 443
| where Protocol == "Tcp" and ActionType == "ConnectionSuccess"
| where Timestamp > ago(7d)
| where RemoteIP in(IPs)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment