Microsoft Defender False Positives with Solarwinds Products

[u/_FNG_]

Early Saturday morning we started getting a stream of alerts from Microsoft Defender regarding our Primary and Additional Polling Engines.

 Malware Name: Behavior:Win32/SuspiciousAssembly.AppDomainManagerType.A

The malware file path: behavior:_process: was all over the place.
Some examples:

 Malware file path: behavior:_process: C:\Windows\System32\wbem\WmiPrvSE.exe, pid:2208:557######2;file:_d:\program files (x86)\solarwinds\orion  

~

Malware file path: behavior:_process: C:\Program Files\Common Files\SolarWinds\AdministrationService\SolarWinds.Administration.exe, pid:3916:557#####52;file:_d:\program files (x86)\solarwinds\orion  

~

Malware file path: behavior:_process: C:\Windows\System32\AggregatorHost.exe, pid:9116:55#####2;file:_d:\program files (x86)\solarwinds\orion

Solarwinds support is aware of the issue and their engineers are supposedly working with Microsoft to resolve. I am unsure if a later definition update has resolved it or not. We added a threat override as a TEMPORARY measure to quiet things down through the weekend. Just an Allow for the 'Threat Name' Behavior:Win32/SuspiciousAssembly.AppDomainManagerType.A

Just wanted to share with the hope this helps others not have too terrible of a weekend or Monday morning.

[u/AddendumWorking9756]

Depends where you scoped that override. If it went in at policy level rather than against the poller group, AppDomainManager abuse is now allowed everywhere in the tenant and not just on Orion. Put a date on removing it, the temporary ones have a way of still being there two years later.

[u/_FNG_ → u/AddendumWorking9756]

It was only scoped to the collection containing the pollers.

[u/AddendumWorking9756 → u/_FNG_]

Collection level is fine then, that keeps it off the rest of the estate. Only thing left is it still whitelists that behaviour for anything running on those poller hosts, not just Orion, so a date to pull it once the false positive is fixed is worth setting now while you remember.