Once they find the software, they can reverse-engineer it. Finding it the first time is the difficult part. That can happen based on a tip-off (e.g. every security team in the world will be checking their network for these processes, domain names etc. now), a lucky find (e.g. if the backdoor triggered weird crashes and someone took a look), or because it's linked to some other bad activity (e.g. someone finds some form of known malware and investigates how it got there).
In this case, it's likely that they somehow found the backdoor in SolarWinds' network and realized what was happening that way.
In this case, it's likely that they somehow found the backdoor in SolarWinds' network and realized what was happening that way.