Rich Rumble richrumble

## sunburst_countermeasures.md

      
        
          
            
              
              1 file
            
          
          
            
              
              0 forks
            
          
          
            
              
              1 comment
            
          
          
            
              
              15 stars
            
          
        
        
          
              
          
          
            
                olafhartong
                / sunburst_countermeasures.md
            
            
              Created
              December 14, 2020 08:47
            
          
        
      
        
  
      
    FireEye Sunburst KQL Detections

FireEye released a very interesting article regarding a third-party compromise of Solarwinds, the detections that are possible in Defender for Endpoint are listed below
Blog post
All FireEye detections
DeviceEvents