SolarWinds Orion API auth bypass probing via suspicious WebResource.axd and i18n.ashx paths

title: SolarWinds Orion API auth bypass probing via suspicious WebResource.axd and i18n.ashx paths
id: 425b76b2-9e51-401d-be66-2b3477a2e36c
status: test
description: This rule flags web requests whose query string contains specific Orion-related endpoints and resource handlers associated with attempts to bypass API authentication. Such probing matters because unauthenticated access to Orion API functionality can enable further compromise of monitored infrastructure. The detection relies on webserver HTTP telemetry, specifically matching URL query-string fragments like /WebResource.axd, /ScriptResource.axd, /SolarWinds/, and /api/ while excluding known benign request patterns.
references:
  - https://kb.cert.org/vuls/id/843464
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-10148/web_cve_2020_10148_solarwinds_exploit.yml
author: Bhabesh Raj, Tim Shelton, Huntrule Team
date: 2020-12-27
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2020-10148
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - /WebResource.axd
      - /ScriptResource.axd
      - /i18n.ashx
      - /Skipi18n
  selection2:
    cs-uri-query|contains:
      - /SolarWinds/
      - /api/
  valid_request_1:
    cs-uri-query|contains: Orion/Skipi18n/Profiler/
  valid_request_2:
    cs-uri-query|contains:
      - css.i18n.ashx
      - js.i18n.ashx
  condition: all of selection* and not 1 of valid_request_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 5a35116f-43bc-4901-b62d-ef131f42a9af
    type: derived