Merge pull request #1312 from Neo23x0/rule-devel

rule: Solarwinds SUPERNOVA web shell access
2020-12-21 11:30:56 +01:00
parent 80e1a5e7eb 9c8e1387a9
commit 1bb249c6ec
1 changed files with 25 additions and 0 deletions
@@ -0,0 +1,25 @@
+title: Solarwinds SUPERNOVA Webshell Access
+id: a2cee20b-eacc-459f-861d-c02e5d12f1db
+status: experimental
+description: Detects access to SUPERNOVA webshell as described in Guidepoint report
+author: Florian Roth
+date: 2020/12/17
+references:
+    - https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/
+tags:
+    - attack.persistence
+    - attack.t1505.003
+logsource:
+    category: webserver
+detection:
+    selection:
+        c-uri|contains|all:
+            - 'logoimagehandler.ashx'
+            - 'clazz'
+    condition: selection
+fields:
+    - client_ip
+    - response
+falsepositives:
+    - Unknown
+level: critical