CHIRP Detection Tool
Share this:
CISA has released a new tool to detect post-compromise malicious activity associated with the SolarWinds hackers in on-premises enterprise environments. CISA Hunt and Incident Response Program (CHIRP), the new forensics collection tool, is a Python-based tool that helps detect SolarWinds malicious activity IOCs on Windows operating systems.
Similar to REvil ransomware has a new ‘Windows Safe Mode’ encryption mode
Sparrow—which scans for signs of APT compromise within an M365 or Azure environment—CHIRP scans for signs of APT compromise within an on-premises environment.
CHIRP, by default, searches for IOCs associated with malicious activity detailed in AA20-352A and AA21-008A that has spilled into an on-premises enterprise environment.
The two alerts refer to the SolarWinds hackers’ compromise of government agencies, critical infrastructure, and private sector organizations using trojanized SolarWinds Orion products and compromised apps the victims’ Microsoft 365 (M365)/Azure environment as initial access vectors.
How CHIRP works ?
When performing the scan, CHIRP outputs JSON formatted data for further analysis in a SIEM or similar tools. CISA advises organizations to use CHIRP to analyze their environment when they want to:
Examine Windows event logs for artifacts associated with this activity;
Examine Windows Registry for evidence of intrusion;
Query Windows network artifacts; and
Apply YARA rules to detect malware, backdoors, or implants.
Enterprise admins can use CHIP to look for:
✓The presence of malware identified by security researchers as TEARDROP and RAINDROP;
✓Credential dumping certificate pulls;
✓Certain persistence mechanisms identified as associated with this campaign;
System, network, and M365 enumeration;
✓Known observable indicators of lateral movement.
CISA previously released a PowerShell based tool dubbed Sparrow that helps detect potentially compromised apps and accounts in Azure/Microsoft 365 environments.
CrowdStrike & FireEye already released tool to detect SolarWinds Attack
The SolarWinds hackers are tracked as UNC2452 (FireEye), StellarParticle (CrowdStrike), SolarStorm (Palo Alto Unit 42), Dark Halo (Volexity), and Nobelium (Microsoft).
1 thought on “CHIRP Detection Tool”