hightestEmerging Threat
UNC2452 Process Creation Patterns
Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries
windowsprocess_creation
2024-09-12
Emerging Threats
Actor2020
SolarWinds Supply Chain
4Rules
7References
1Folders
2024-09-12Latest
Summary
SolarWinds Supply Chain is tracked here as a threat actor, intrusion set, or campaign with 4 Sigma detections spanning 2020. Coverage centers on windows / process_creation, webserver.
Related Detections
Search this threatcriticaltestEmerging Threat
Solarwinds SUPERNOVA Webshell Access
Detects access to SUPERNOVA webshell as described in Guidepoint report
Generalwebserver
2023-01-02
hightestEmerging Threat
Suspicious VBScript UN2452 Pattern
Detects suspicious inline VBScript keywords as used by UNC2452
windowsprocess_creation
2022-10-09
criticaltestEmerging Threat
UNC2452 PowerShell Pattern
Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports
windowsprocess_creation
2022-10-09
References