Branch was auto-updated.

baselines/previously_seen_running_windows_services.yml

@@ -18,7 +18,7 @@ tags:
   analytic_story:
   - Orangeworm Attack Group
   - Windows Service Abuse
-  - Sunburst Malware
+  - NOBELIUM Group
   deployments:
   - 90 Day Baseline
   detections:

baselines/previously_seen_running_windows_services_update.yml

@@ -23,7 +23,7 @@ tags:
   analytic_story:
   - Orangeworm Attack Group
   - Windows Service Abuse
-  - Sunburst Malware
+  - NOBELIUM Group
   deployments:
   - Hourly Cache Updates
   detections:

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -20,7 +20,8 @@ how_to_implement: This search needs Sysmon Logs and a sysmon configuration, whic
   with configurations for your Splunk environment. The search also uses a post-filter
   macro designed to filter out known false positives.
 known_false_positives: Other tools can import the same DLLs. These tools should be
-  part of a whitelist.
+  part of a whitelist. False positives may be present with any process that authenticates
+  or uses credentials, PowerShell included. Filter based on parent process.
 references:
 - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html
 tags:
@@ -44,3 +45,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -27,7 +27,7 @@ tags:
   - Suspicious Command-Line Executions
   - Suspicious MSHTA Activity
   - Suspicious Zoom Child Processes
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_rundll32_inline_hta_execution.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
+  - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -25,7 +25,7 @@ references: []
 tags:
   analytic_story:
   - Malicious PowerShell
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/sc_exe_manipulating_windows_services.yml

@@ -28,7 +28,7 @@ tags:
   - Orangeworm Attack Group
   - Windows Persistence Techniques
   - Disabling Security Tools
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -25,7 +25,7 @@ references: []
 tags:
   analytic_story:
   - DHS Report TA18-074A
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/schtasks_scheduling_job_on_remote_system.yml

@@ -26,7 +26,7 @@ references: []
 tags:
   analytic_story:
   - Lateral Movement
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/windows_adfind_exe.yml

@@ -29,7 +29,7 @@ references:
 - https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html
 tags:
   analytic_story:
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/experimental/endpoint/first_time_seen_running_windows_service.yml

@@ -28,7 +28,7 @@ tags:
   analytic_story:
   - Windows Service Abuse
   - Orangeworm Attack Group
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Endpoint
   cis20:
   - CIS 2

detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml

@@ -23,7 +23,7 @@ references:
 - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
 tags:
   analytic_story:
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Windows
   cis20:
   - CIS 6

detections/experimental/web/supernova_webshell.yml

@@ -23,7 +23,7 @@ references:
 - https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/
 tags:
   analytic_story:
-  - Sunburst Malware
+  - NOBELIUM Group
   cis20:
   - CIS 4
   - CIS 13

detections/network/detect_outbound_smb_traffic.yml

@@ -41,7 +41,7 @@ tags:
   analytic_story:
   - Hidden Cobra Malware
   - DHS Report TA18-074A
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Endpoint
   cis20:
   - CIS 12

detections/network/tor_traffic.yml

@@ -26,7 +26,7 @@ tags:
   - Prohibited Traffic Allowed or Protocol Mismatch
   - Ransomware
   - Command and Control
-  - Sunburst Malware
+  - NOBELIUM Group
   asset_type: Endpoint
   cis20:
   - CIS 9

stories/nobelium_group.yml

@@ -1,24 +1,25 @@
-name: Sunburst Malware
+name: NOBELIUM Group
 id: 758196b5-2e21-424f-a50c-6e421ce926c2
-version: 1
+version: 2
 date: '2020-12-14'
-author: Patrick Bareiss, Splunk
+author: Patrick Bareiss, Michael Haag, Splunk
 type: batch
 description: Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and
   management software. It was discovered by FireEye in December 2020. The actors behind
   this campaign gained access to numerous public and private organizations around
   the world.
 narrative: This Analytic Story supports you to detect Tactics, Techniques and Procedures
-  (TTPs) from the Sunburst malware. The threat actor behind sunburst compromised the
+  (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the
   SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component
   of the Orion software framework that contains a backdoor that communicates via HTTP
   to third party servers. The detections in this Analytic Story are focusing on the
   dll loading events, file create events and network events to detect This malware.
 references:
+- https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
 - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
 - https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
 tags:
-  analytic_story: Sunburst Malware
+  analytic_story: NOBELIUM Group
   category:
   - Adversary Tactics
   product:

tests/endpoint/detect_mimikatz_using_loaded_images.test.yml

@@ -0,0 +1,12 @@
+name: Detect Mimikatz Using Loaded Images Unit Test
+tests:
+- name: Detect Mimikatz Using Loaded Images
+  file: endpoint/detect_mimikatz_using_loaded_images.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog