mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
54 lines
1.6 KiB
YAML
54 lines
1.6 KiB
YAML
name: Supernova Webshell
|
|
id: 2ec08a09-9ff1-4dac-b59f-1efd57972ec1
|
|
version: 1
|
|
date: '2021-01-06'
|
|
author: John Stoner, Splunk
|
|
type: batch
|
|
datamodel:
|
|
- Web
|
|
description: This search aims to detect the Supernova webshell used in the SUNBURST
|
|
attack.
|
|
search: '| tstats `security_content_summariesonly` count from datamodel=Web.Web where
|
|
web.url=*logoimagehandler.ashx*codes* OR Web.url=*logoimagehandler.ashx*clazz* OR
|
|
Web.url=*logoimagehandler.ashx*method* OR Web.url=*logoimagehandler.ashx*args* by
|
|
Web.src Web.dest Web.url Web.vendor_product Web.user Web.http_user_agent _time span=1s
|
|
| `supernova_webshell_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be monitoring
|
|
web traffic to your Solarwinds Orion. The logs should be ingested into splunk and
|
|
populating/mapped to the Web data model.
|
|
known_false_positives: There might be false positives associted with this detection
|
|
since items like args as a web argument is pretty generic.
|
|
references:
|
|
- https://www.splunk.com/en_us/blog/security/detecting-supernova-malware-solarwinds-continued.html
|
|
- https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/
|
|
tags:
|
|
analytic_story:
|
|
- NOBELIUM Group
|
|
cis20:
|
|
- CIS 4
|
|
- CIS 13
|
|
- CIS 18
|
|
kill_chain_phases:
|
|
- Exfiltration
|
|
mitre_attack_id:
|
|
- T1505.003
|
|
nist:
|
|
- PR.DS
|
|
- ID.RA
|
|
- PR.PT
|
|
- PR.IP
|
|
- DE.CM
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Web.url
|
|
- Web.src
|
|
- Web.dest
|
|
- Web.vendor_product
|
|
- Web.user
|
|
- Web.http_user_agent
|
|
security_domain: network
|