Threat report

www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations

https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

Published on: www.volexity.com
Sources in this catalogue: 2

ATT&CK techniques those detections carry

T1059Command and Scripting Interpreter
T1059.001PowerShell
T1114Email Collection
T1114.002Remote Email Collection
T1005Data from Local System
T1114.001Local Email Collection
T1018Remote System Discovery
T1021Remote Services
+7 more

5 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Windows AdFind Exe	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
New ActiveSyncAllowedDeviceID Added via PowerShell	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Outbound Scheduled Task Activity via PowerShell	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Exchange Mailbox Export via PowerShell	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Exporting Exchange Mailbox via PowerShell	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 5 of 5

Filter in the catalogue