splunk-security_content/docs/_posts/2021-01-06-supernova_webshell.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Supernova Webshell	Web Shell	Web	2021-01-06	true		TTP T1505.003 Web Shell Persistence Splunk Enterprise Splunk Enterprise Security Splunk Cloud Web Exfiltration

⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION

We have not been able to test, simulate or build datasets for it, use at your own risk!

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This search aims to detect the Supernova webshell used in the SUNBURST attack.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Web
• Last Updated: 2021-01-06
• Author: John Stoner, Splunk
• ID: 2ec08a09-9ff1-4dac-b59f-1efd57972ec1

ATT&CK

ID	Technique	Tactic
T1505.003	Web Shell	Persistence

Search

| tstats `security_content_summariesonly` count from datamodel=Web.Web where web.url=*logoimagehandler.ashx*codes* OR Web.url=*logoimagehandler.ashx*clazz* OR Web.url=*logoimagehandler.ashx*method* OR Web.url=*logoimagehandler.ashx*args* by Web.src Web.dest Web.url Web.vendor_product Web.user Web.http_user_agent _time span=1s 
| `supernova_webshell_filter`

Associated Analytic Story

• NOBELIUM Group

How To Implement

To successfully implement this search, you need to be monitoring web traffic to your Solarwinds Orion. The logs should be ingested into splunk and populating/mapped to the Web data model.

Required field

• _time
• Web.url
• Web.src
• Web.dest
• Web.vendor_product
• Web.user
• Web.http_user_agent

Kill Chain Phase

• Exfiltration

Known False Positives

There might be false positives associted with this detection since items like args as a web argument is pretty generic.

Reference

• https://www.splunk.com/en_us/blog/security/detecting-supernova-malware-solarwinds-continued.html
• https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1