SUPERNOVA webshell

Back


Id	2acc91c3-17c2-4388-938e-4eac2d5894e8
Rulename	SUPERNOVA webshell
Description	Identifies SUPERNOVA webshell based on W3CIISLog data. References: - https://unit42.paloaltonetworks.com/solarstorm-supernova/
Severity	High
Tactics	Persistence CommandAndControl
Techniques	T1505 T1071
Required data connectors	AzureMonitor(IIS)
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Web Shells Threat Protection/Analytic Rules/Supernovawebshell.yaml
Version	1.0.4
Arm template	2acc91c3-17c2-4388-938e-4eac2d5894e8.json

KQL

W3CIISLog
| where csMethod == 'GET'
| where isnotempty(csUriStem) and isnotempty(csUriQuery)
| where csUriStem contains "logoimagehandler.ashx"
| where csUriQuery contains "codes" and csUriQuery contains "clazz" and csUriQuery contains "method" and csUriQuery contains "args"
| extend timestamp = TimeGenerated
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(csUserName, "@")[0]), AccountUPNSuffix = tostring(split(csUserName, "@")[1])

YAML

triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: csUserName
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: Computer
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: HostNameDomain
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: cIP
requiredDataConnectors:
- dataTypes:
  - W3CIISLog
  connectorId: AzureMonitor(IIS)
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Web Shells Threat Protection/Analytic Rules/Supernovawebshell.yaml
name: SUPERNOVA webshell
relevantTechniques:
- T1505
- T1071
query: |
  W3CIISLog
  | where csMethod == 'GET'
  | where isnotempty(csUriStem) and isnotempty(csUriQuery)
  | where csUriStem contains "logoimagehandler.ashx"
  | where csUriQuery contains "codes" and csUriQuery contains "clazz" and csUriQuery contains "method" and csUriQuery contains "args"
  | extend timestamp = TimeGenerated
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | extend AccountName = tostring(split(csUserName, "@")[0]), AccountUPNSuffix = tostring(split(csUserName, "@")[1])  
version: 1.0.4
queryPeriod: 1d
kind: Scheduled
id: 2acc91c3-17c2-4388-938e-4eac2d5894e8
description: |
  'Identifies SUPERNOVA webshell based on W3CIISLog data.
   References:
   - https://unit42.paloaltonetworks.com/solarstorm-supernova/'  
queryFrequency: 1d
severity: High
triggerOperator: gt
tactics:
- Persistence
- CommandAndControl
metadata:
  source:
    kind: Scheduled
  categories:
    domains:
    - Security - Others
  support:
    tier: Community
  author:
    name: Microsoft Security Research

ARM