SUNBURST

Malware & Tools · SUNBURST

· MalwareS0559 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

SUNBURST is a trojanized DLL designed to fit within the SolarWinds Orion software update framework. It was used by APT29 since at least February 2020.(Citation: SolarWinds Sunburst Sunspot Update January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)

Tactic Coverage

discovery (11)stealth (11)command and control (9)defense impairment (3)execution (2)persistence (2)collection (1)privilege escalation (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (36)

T1001.001Junk Data

command and control

T1001.002Steganography

command and control

T1001.003Protocol or Service Impersonation

command and control

T1005Data from Local System

collection

T1007System Service Discovery

discovery

T1012Query Registry

discovery

T1016System Network Configuration Discovery

References

https://attack.mitre.org/software/S0559 https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/

T1027Obfuscated Files or Information

stealth

T1027.005Indicator Removal from Tools

stealth

T1027.015Compression

stealth

T1033System Owner/User Discovery

discovery

T1036.005Match Legitimate Resource Name or Location

stealth

T1047Windows Management Instrumentation

execution

T1057Process Discovery

discovery

T1059.005Visual Basic

execution

T1070Indicator Removal

stealth

T1070.004File Deletion

stealth

T1070.007Clear Network Connection History and Configurations

stealth

T1070.009Clear Persistence

stealth

T1071.001Web Protocols

command and control

T1071.004DNS

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1105Ingress Tool Transfer

command and control

T1112Modify Registry

defense impairmentpersistence

T1124System Time Discovery

discovery

T1132.001Standard Encoding

command and control

T1218.011Rundll32

stealth

T1497.001System Checks

stealthdiscovery

T1497.003Time Based Checks

stealthdiscovery

T1518.001Security Software Discovery

discovery

T1546.012Image File Execution Options Injection

privilege escalationpersistence

T1553.002Code Signing

defense impairment

T1568Dynamic Resolution

command and control

T1573.001Symmetric Cryptography

command and control

T1685Disable or Modify Tools

defense impairment