In addition to the vendor patch that should be applied, Trend Micro has released several detection patterns, rules and filters that can provide protection and detection against malicious components associated with this attack. In addition, it is highly recommended that affected customers also closely follow SolarWinds' official advisory and also reference CISA's Emergency Directive 21-01 for the US Government for more specific information.įirst and foremost, it is highly recommended that all customers follow the guidance from SolarWinds and other agencies such as CISA to isolate and/or disconnect affected products until the necessary hotfixes are applied and the systems are certified safe. Specific technical information on the Sunburst threat itself can be found in the following Trend Micro blog: Overview of Recent Sunburst Targeted Attacks. This article will cover various Trend Micro product detection and protection patterns, rules and filters that have been deployed to help organizations investigate and mitigate additional risk against threats associated with this campaign as well as highlighting Trend Micro technology that can assist in investigation. Many of the malicious components found as part of the attack have been dubbed 'Sunburst.' 12, 2020 with new Cloud One / Deep Security Rulesīeginning on December 13, 2020, public information began to circulate about a massive sophisticated attack via supply chain that affected the popular SolarWinds Orion and associated products.

Virus protection trend micro