mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
29 lines
1.4 KiB
YAML
29 lines
1.4 KiB
YAML
name: NOBELIUM Group
|
|
id: 758196b5-2e21-424f-a50c-6e421ce926c2
|
|
version: 2
|
|
date: '2020-12-14'
|
|
author: Patrick Bareiss, Michael Haag, Splunk
|
|
description: Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and
|
|
management software. It was discovered by FireEye in December 2020. The actors behind
|
|
this campaign gained access to numerous public and private organizations around
|
|
the world.
|
|
narrative: This Analytic Story supports you to detect Tactics, Techniques and Procedures
|
|
(TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll,
|
|
is a SolarWinds digitally-signed component of the Orion software framework that
|
|
contains a backdoor that communicates via HTTP to third party servers. The detections
|
|
in this Analytic Story are focusing on the dll loading events, file create events
|
|
and network events to detect This malware.
|
|
references:
|
|
- https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
|
|
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
|
|
- https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
|
|
tags:
|
|
analytic_story: NOBELIUM Group
|
|
category:
|
|
- Adversary Tactics
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|