Adding Solorigate context for the generic backdoor queries.

raulgarciamsft · raulgarciamsft · commit 681e6a9303d6 · 2021-02-05T09:02:59.000-08:00
diff --git a/csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qhelp b/csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qhelp
@@ -5,4 +5,10 @@
   <overview>
     <p>This query finds native calls to external functions that are often used in creating backdoors or are generally attributed to unsafe code practices.</p>
   </overview>
+
+  <recommendation>
+    <p>Any findings from this rules is only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack, but no certainty that the code is related or part of any attack.</p>
+    <p>For more information about Solorigate, please visit https://aka.ms/solorigate. </p>
+  </recommendation>
+
 </qhelp>
diff --git a/csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.qhelp b/csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.qhelp
@@ -5,4 +5,10 @@
   <overview>
     <p>This query finds if there exists a DataFlow from a file last modification date (very likely implant installation time) and an offset to a condition statement (the trigger) that controls code execution.</p>
   </overview>
+
+  <recommendation>
+    <p>Any findings from this rules is only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack, but no certainty that the code is related or part of any attack.</p>
+    <p>For more information about Solorigate, please visit https://aka.ms/solorigate. </p>
+  </recommendation>
+
 </qhelp>
diff --git a/csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qhelp b/csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qhelp
@@ -6,4 +6,10 @@
     <p>This query detects code flow from ProcessName property on the Process class into a hash function.</p>
     <p>Such flow is often used in code backdoors to detect runnig processes and compare them to an obfuscated list of antivirus processes to aviod detection.</p>
   </overview>
+
+  <recommendation>
+    <p>Any findings from this rules is only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack, but no certainty that the code is related or part of any attack.</p>
+    <p>For more information about Solorigate, please visit https://aka.ms/solorigate. </p>
+  </recommendation>
+
 </qhelp>
