Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. rule "command_and_control_sunburst_dst_hostname"
  2. // https://github.com/fireeye/sunburst_countermeasures/blob/main/indicator_release/Indicator_Release_NBIs.csv
  3. // https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
  4. // https://github.com/sophos-cybersecurity/solarwinds-threathunt/blob/master/iocs.csv
  5. when
  6. has_field("dst_ip_is_internal")
  7. AND
  8. to_string($message.dst_ip_is_internal) == "false"
  9. AND
  10. has_field("dst_hostname")
  11. AND
  12. (
  13. contains(to_string($message.dst_hostname), "avsvmcloud.com", true)
  14. OR
  15. contains(to_string($message.dst_hostname), "freescanonline.com", true)
  16. OR
  17. contains(to_string($message.dst_hostname), "deftsecurity.com", true)
  18. OR
  19. contains(to_string($message.dst_hostname), "thedoccloud.com", true)
  20. OR
  21. contains(to_string($message.dst_hostname), "websitetheme.com", true)
  22. OR
  23. contains(to_string($message.dst_hostname), "highdatabase.com", true)
  24. OR
  25. contains(to_string($message.dst_hostname), "incomeupdate.com", true)
  26. OR
  27. contains(to_string($message.dst_hostname), "databasegalore.com", true)
  28. OR
  29. contains(to_string($message.dst_hostname), "panhardware.com", true)
  30. OR
  31. contains(to_string($message.dst_hostname), "zupertech.com", true)
  32. OR
  33. contains(to_string($message.dst_hostname), "digitalcollege.org", true)
  34. OR
  35. contains(to_string($message.dst_hostname), "globalnetworkissues.com", true)
  36. OR
  37. contains(to_string($message.dst_hostname), "kubecloud.com", true)
  38. OR
  39. contains(to_string($message.dst_hostname), "lcomputers.com", true)
  40. OR
  41. contains(to_string($message.dst_hostname), "seobundlekit.com", true)
  42. OR
  43. contains(to_string($message.dst_hostname), "virtualwebdata.com", true)
  44. OR
  45. contains(to_string($message.dst_hostname), "webcodez.com", true)
  46. )
  47.  
  48. then
  49. set_field("threat_detected", true);
  50. set_field("threat_name", "command_and_control_sunburst_dst_hostname");
  51. set_field("threat_desc", "Detected an outbound connection to a known sunburst c2 domain");
  52. set_field("threat_tactic", "command_and_control");
  53. set_field("threat_score", 10);
  54.  
  55. end