New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
A newer version is available. For the latest information, see the current release documentation.
« SSH Authorized Keys File Modification Scheduled Task Created by a Windows Script »
Elastic Docs ›Elastic Security Solution [7.17] ›Detections and alerts ›Prebuilt rule reference

SUNBURST Command and Control Activity

edit

SUNBURST Command and Control Activity

edit

The malware known as SUNBURST targets the SolarWind’s Orion business software for command and control. This rule detects post-exploitation command and control activity of the SUNBURST backdoor.

Rule type: eql

Rule indices:

  • logs-endpoint.events.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Command and Control

Version: 4 (version history)

Added (Elastic Stack release): 7.11.0

Last modified (Elastic Stack release): 7.13.0

Rule authors: Elastic

Rule license: Elastic License v2

Investigation guide

edit
## Triage and analysis

The SUNBURST malware attempts to hide within the Orion Improvement Program (OIP) network traffic. As this rule detects post-exploitation network traffic, investigations into this should be prioritized.

Rule query

edit
network where event.type == "protocol" and network.protocol == "http"
and process.name : ("ConfigurationWizard.exe",
"NetFlowService.exe",
"NetflowDatabaseMaintenance.exe",
"SolarWinds.Administration.exe",
"SolarWinds.BusinessLayerHost.exe",
"SolarWinds.BusinessLayerHostx64.exe",
"SolarWinds.Collector.Service.exe",
"SolarwindsDiagnostics.exe") and (http.request.body.content :
"*/swip/Upload.ashx*" and http.request.body.content : ("POST*",
"PUT*")) or (http.request.body.content :
("*/swip/SystemDescription*", "*/swip/Events*") and
http.request.body.content : ("GET*", "HEAD*")) and not
http.request.body.content : "*solarwinds.com*"

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 4 (7.13.0 release)

  • Updated query, changed from:

    event.category:network and event.type:protocol and
network.protocol:http and process.name:( ConfigurationWizard.exe or
NetFlowService.exe or NetflowDatabaseMaintenance.exe or
SolarWinds.Administration.exe or SolarWinds.BusinessLayerHost.exe or
SolarWinds.BusinessLayerHostx64.exe or
SolarWinds.Collector.Service.exe or SolarwindsDiagnostics.exe) and
http.request.body.content:(( (*/swip/Upload.ashx* and (POST* or PUT*))
or (*/swip/SystemDescription* and (GET* or HEAD*)) or (*/swip/Events*
and (GET* or HEAD*))) and not *solarwinds.com*)
Version 3 (7.12.0 release)
  • Formatting only
Version 2 (7.11.2 release)
  • Formatting only
« SSH Authorized Keys File Modification Scheduled Task Created by a Windows Script »

On this page

Was this helpful?
Feedback