SUPERNOVA webshell

Severity: high
Time window: 1d
Author: Microsoft Security Research
Source: github.com/Azure/Azure-Sentinel

'Identifies SUPERNOVA webshell based on W3CIISLog data. References: - https://unit42.paloaltonetworks.com/solarstorm-supernova/'

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505` Server Software Component
Command & Control	`T1071` Application Layer Protocol

Rule body

id: 2acc91c3-17c2-4388-938e-4eac2d5894e8
name: SUPERNOVA webshell
description: |
  'Identifies SUPERNOVA webshell based on W3CIISLog data.
   References:
   - https://unit42.paloaltonetworks.com/solarstorm-supernova/'
severity: High
requiredDataConnectors:
  - connectorId: AzureMonitor(IIS)
    dataTypes:
      - W3CIISLog
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - CommandAndControl
relevantTechniques:
  - T1505
  - T1071
query: |
  W3CIISLog
  | where csMethod == 'GET'
  | where isnotempty(csUriStem) and isnotempty(csUriQuery)
  | where csUriStem contains "logoimagehandler.ashx"
  | where csUriQuery contains "codes" and csUriQuery contains "clazz" and csUriQuery contains "method" and csUriQuery contains "args"
  | extend timestamp = TimeGenerated
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | extend AccountName = tostring(split(csUserName, "@")[0]), AccountUPNSuffix = tostring(split(csUserName, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: csUserName
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: cIP
version: 1.0.4
kind: Scheduled
metadata:
    source:
        kind: Scheduled
    author:
        name: Microsoft Security Research
    support:
        tier: Community
    categories:
        domains: [ "Security - Others" ]

Stages and Predicates

Stage 1: `source`

W3CIISLog

Stage 2: `where`

| where csMethod == 'GET'

Stage 3: `where`

| where isnotempty(csUriStem) and isnotempty(csUriQuery)

Stage 4: `where`

| where csUriStem contains "logoimagehandler.ashx"

Stage 5: `where`

| where csUriQuery contains "codes" and csUriQuery contains "clazz" and csUriQuery contains "method" and csUriQuery contains "args"

Stage 6: `extend` (4 consecutive steps)

| extend timestamp = TimeGenerated
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(csUserName, "@")[0]), AccountUPNSuffix = tostring(split(csUserName, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`csMethod`	eq	`GET`	`field:"csMethod" kind:eq value:"GET"`
`csUriQuery`	contains	`args` `clazz` `codes` `method`	`field:"csUriQuery" kind:contains`
`csUriQuery`	is_not_null	(no value, null check)	`field:"csUriQuery" kind:is_not_null`
`csUriStem`	contains	`logoimagehandler.ashx`	`field:"csUriStem" kind:contains value:"logoimagehandler.ashx"`
`csUriStem`	is_not_null	(no value, null check)	`field:"csUriStem" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`timestamp`	`extend`
`DomainIndex`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`

SUPERNOVA webshell

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: extend (4 consecutive steps)