Emerging Threatcriticaltest
Solarwinds SUPERNOVA Webshell Access
Detects access to SUPERNOVA webshell as described in Guidepoint report
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems)Created Thu Dec 17Updated Mon Jan 02a2cee20b-eacc-459f-861d-c02e5d12f1db2020
Emerging Threat
Active Threat
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Log Source
Web Server Log
CategoryWeb Server Log← raw: webserver
HTTP access logs from web servers capturing request paths, methods, and status codes.
Detection Logic
Detection Logic2 selectors
detection:
selection1:
cs-uri-query|contains|all:
- 'logoimagehandler.ashx'
- 'clazz'
selection2:
cs-uri-query|contains: 'logoimagehandler.ashx'
sc-status: 500
condition: selection1 or selection2False Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Rule Metadata
Rule ID
a2cee20b-eacc-459f-861d-c02e5d12f1db
Status
test
Level
critical
Type
Emerging Threat
Created
Thu Dec 17
Modified
Mon Jan 02
Path
rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/web_solarwinds_supernova_webshell.yml
Raw Tags
attack.persistenceattack.t1505.003detection.emerging-threats