Solarwinds SUPERNOVA Webshell Access

Status: test
Severity: critical
Log source: category webserver
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects access to SUPERNOVA webshell as described in Guidepoint report

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Rule body

title: Solarwinds SUPERNOVA Webshell Access
id: a2cee20b-eacc-459f-861d-c02e5d12f1db
status: test
description: Detects access to SUPERNOVA webshell as described in Guidepoint report
references:
    - https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/
    - https://www.anquanke.com/post/id/226029
author: Florian Roth (Nextron Systems)
date: 2020-12-17
modified: 2023-01-02
tags:
    - attack.persistence
    - attack.t1505.003
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection1:
        cs-uri-query|contains|all:
            - 'logoimagehandler.ashx'
            - 'clazz'
    selection2:
        cs-uri-query|contains: 'logoimagehandler.ashx'
        sc-status: 500
    condition: selection1 or selection2
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: `condition`

selection1 or selection2

Stage 1: `selection1`

selection1:
    cs-uri-query|contains|all:
        - 'logoimagehandler.ashx'
        - 'clazz'

Stage 2: `selection2`

selection2:
    cs-uri-query|contains: 'logoimagehandler.ashx'
    sc-status: 500

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-uri-query`	match	`clazz` `logoimagehandler.ashx`	`field:"cs-uri-query" kind:match`
`sc-status`	eq	`500`	`field:"sc-status" kind:eq value:"500"`

Solarwinds SUPERNOVA Webshell Access

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection1

Stage 2: selection2

Indicators

Stage 0: `condition`

Stage 1: `selection1`

Stage 2: `selection2`