Does Check Point have a response to the Solarwinds compromise as of yet?

[Paul_Warnagiris]

https://www.cisa.gov/news/2020/12/13/cisa-issues-emergency-directive-mitigate-compromise-solarwinds-... or https://isc.sans.edu/forums/diary/SolarWinds+Breach+Used+to+Infiltrate+Customer+Networks+Solarigate/...

Thanks,

Paul

[_Val_]

AFAIK, the all publicly available IOCs are inserted to the ThreatCloud. All Check Point customers with NGTX enabled can benefit from that already.

We are working on the official response, please stand by.

[schwilj]

What about customers using Sandblast Advanced Endpoint Protection? Will then Anti-Bot, Anti-Ransomware, Threat Emulation blades or any other blades be able to detect the malicious dll files or other IOC?

[PhoneBoy]

As of this moment, there is a protection in Anti-Virus for this, with Anti-Bot and Threat Emulation protections coming shortly.
SBA uses the same ThreatCloud as our gateway and can leverage the same protections.
Official response: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...