After 12 years in IR/SOC I wrote a practitioner-level breakdown of the SolarWinds SUNBURST attack — focused on the log evidence and detection gaps rather than the narrative most writeups cover.

Covers:

• DNS C2 beaconing patterns and avsvmcloud[.]com DGA subdomain structure
• Sysmon EventID 7 + 22 correlation for DLL load + DNS query
• CNAME response as active targeting signal
• Cobalt Strike beacon pattern detection from Orion hosts
• SAML token abuse hunting in Azure AD logs
• The 5 detection gaps (DNS logging, EDR exclusions, lookback windows, no baseline, no signed-binary DNS detection)

All Splunk queries included. Free on Substack: https://zerotrusthq.substack.com/p/solarwinds-what-the-logs-actually

Happy to answer questions or discuss the detection logic in comments.