SUPERNOVA webshell

Back


Id	2acc91c3-17c2-4388-938e-4eac2d5894e8
Rulename	SUPERNOVA webshell
Description	Identifies SUPERNOVA webshell based on W3CIISLog data. References: - https://unit42.paloaltonetworks.com/solarstorm-supernova/
Severity	High
Tactics	Persistence CommandAndControl
Techniques	T1505 T1071
Required data connectors	AzureMonitor(IIS)
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Web Shells Threat Protection/Analytic Rules/Supernovawebshell.yaml
Version	1.0.4
Arm template	2acc91c3-17c2-4388-938e-4eac2d5894e8.json

KQL

W3CIISLog
| where csMethod == 'GET'
| where isnotempty(csUriStem) and isnotempty(csUriQuery)
| where csUriStem contains "logoimagehandler.ashx"
| where csUriQuery contains "codes" and csUriQuery contains "clazz" and csUriQuery contains "method" and csUriQuery contains "args"
| extend timestamp = TimeGenerated
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(csUserName, "@")[0]), AccountUPNSuffix = tostring(split(csUserName, "@")[1])

YAML

query: |
  W3CIISLog
  | where csMethod == 'GET'
  | where isnotempty(csUriStem) and isnotempty(csUriQuery)
  | where csUriStem contains "logoimagehandler.ashx"
  | where csUriQuery contains "codes" and csUriQuery contains "clazz" and csUriQuery contains "method" and csUriQuery contains "args"
  | extend timestamp = TimeGenerated
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | extend AccountName = tostring(split(csUserName, "@")[0]), AccountUPNSuffix = tostring(split(csUserName, "@")[1])  
severity: High
queryFrequency: 1d
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: csUserName
    identifier: FullName
  - columnName: AccountName
    identifier: Name
  - columnName: AccountUPNSuffix
    identifier: UPNSuffix
- entityType: Host
  fieldMappings:
  - columnName: Computer
    identifier: FullName
  - columnName: HostName
    identifier: HostName
  - columnName: HostNameDomain
    identifier: DnsDomain
- entityType: IP
  fieldMappings:
  - columnName: cIP
    identifier: Address
queryPeriod: 1d
version: 1.0.4
relevantTechniques:
- T1505
- T1071
id: 2acc91c3-17c2-4388-938e-4eac2d5894e8
metadata:
  author:
    name: Microsoft Security Research
  support:
    tier: Community
  source:
    kind: Scheduled
  categories:
    domains:
    - Security - Others
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Web Shells Threat Protection/Analytic Rules/Supernovawebshell.yaml
description: |
  'Identifies SUPERNOVA webshell based on W3CIISLog data.
   References:
   - https://unit42.paloaltonetworks.com/solarstorm-supernova/'  
triggerOperator: gt
tactics:
- Persistence
- CommandAndControl
kind: Scheduled
name: SUPERNOVA webshell
requiredDataConnectors:
- connectorId: AzureMonitor(IIS)
  dataTypes:
  - W3CIISLog

ARM