CISA AA20-352A

Purpose, scope and authority

This is a historical campaign advisory, not a standing standard. The linked CISA bulletin records the December 2020 warning about compromises affecting government, critical infrastructure and private organisations. SolarWinds Orion was an initial access vector, but the bulletin also warns about activity beyond that vector. Its indicators and product context must not be treated as a complete current detection catalogue. [1]

Principles and operating logic [1]

1. Separate exposure from compromise

Establish whether relevant software and versions existed during the period under investigation. Then examine evidence of activity and access. A product match establishes a reason to investigate; it does not establish every later action or loss. Conversely, absence of the product does not rule out the broader activity described.

2. Investigate identities and trust

The advisory describes activity involving credentials, impersonation and access beyond the initial host. Follow the permissions and trust available to affected systems. A network boundary alone may not represent the investigation boundary when identity can cross into other environments.

3. Use indicators with context

Indicators can support hunting, but their value depends on time, visibility and the evidence retained. Correlate endpoint, network and identity observations. Distinguish a negative search from an inability to search because the relevant telemetry was never collected.

4. Protect response communications

The bulletin warns that findings and mitigation discussions may be sensitive in light of the accounts targeted. Plan how responders exchange evidence and decisions when ordinary email or administrative access may be observed. This is an operational requirement to evaluate, not merely a communications preference.

5. Keep directives distinct

The bulletin references Emergency Directive 21-01. The directive and advisory have different roles and audiences. Do not convert a historical federal direction into a universal legal obligation for every reader. Determine the rules applicable to the actual organisation.

Application · editorial recommendations

Our proposed investigation register separates installation evidence, indicators observed, identity exposure, data-access findings and remaining unknowns. Give each entry a source and time range. Route confirmed activity into incident response; route evidence gaps into a decision about additional investigation and acceptable uncertainty. Use the later eviction guide when studying recovery from the campaign, rather than stopping at the original alert.

Evidence for the CISO · proposed review pack

Ask for historical inventory, retained logs, account and permission history, a timeline of observations, a documented scope decision and a record of containment actions. In a hypothetical supplier review, “we patched” does not answer whether the organisation investigated access that preceded the patch.

Common mistakes and limits

Avoid treating all exposed organisations as confirmed victims of the same impact, relying only on indicator blocking, assuming the patch removes every persistence mechanism, or presenting 2020 detection artefacts as sufficient for today. Study this advisory for investigation reasoning and historical evidence; validate current technical actions separately.

Official sources and reading route

Read these sections in the source: Summary; Technical Details; Mitigations in the linked historical bulletin.

1. CISA AA20-352A · 2020-12-17 · historical advisory
2. CISA · Advisory record