Solarwinds SUPERNOVA Webshell Access

calendar Jun 20, 2023 · attack.persistence attack.t1505.003 detection.emerging_threats  ·
Share on: linkedin copy

Detects access to SUPERNOVA webshell as described in Guidepoint report

Sigma rule (View on GitHub)

 1title: Solarwinds SUPERNOVA Webshell Access
 2id: a2cee20b-eacc-459f-861d-c02e5d12f1db
 3status: test
 4description: Detects access to SUPERNOVA webshell as described in Guidepoint report
 5references:
 6    - https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/
 7    - https://www.anquanke.com/post/id/226029
 8author: Florian Roth (Nextron Systems)
 9date: 2020/12/17
10modified: 2023/01/02
11tags:
12    - attack.persistence
13    - attack.t1505.003
14    - detection.emerging_threats
15logsource:
16    category: webserver
17detection:
18    selection1:
19        cs-uri-query|contains|all:
20            - 'logoimagehandler.ashx'
21            - 'clazz'
22    selection2:
23        cs-uri-query|contains: 'logoimagehandler.ashx'
24        sc-status: 500
25    condition: selection1 or selection2
26fields:
27    - client_ip
28    - response
29falsepositives:
30    - Unknown
31level: critical

References

  • SUPERNOVA SolarWinds .NET Webshell Analysis

    The recently announced supply-chain compromise of SolarWinds and FireEye illustrated many of the threats observed during that investigation, with particular focus being placed on the SUNBURST SolarWinds Orion implant, the memory-resident TEARDROP malware dropper, and usage of Cobalt Strike’s BEACON module. However, in the IOCs listed by FireEye as part of this investigation, a .NET webshell named SUPERNOVA was identified with no supplemental analysis as to its method of operation or any behavioral indications of this webshell being present in an environment.


    Read More

  • SolarWinds失陷服务器测绘分析报告-安全客 - 安全资讯平台

    SolarWinds失陷服务器测绘分析报告 阅读量453396 发布时间 : 2020-12-18 16:00:27 x 译文声明 本文是翻译文章 恶意活动 评论列表


    Read More

Related rules

to-top