mandiant / sunburst_countermeasures Goto Github PK

View Code? Open in Web Editor NEW

561.0 116.0 199.0 84 KB

License: BSD 2-Clause "Simplified" License

YARA 100.00%

sunburst_countermeasures's Introduction

FireEye Mandiant SunBurst Countermeasures

These rules are provided freely to the community without warranty.

In this GitHub repository you will find rules in multiple languages:

Snort
Yara
IOC
ClamAV

The rules are categorized and labeled into two release states:

Production: rules that are expected to perform with minimal tuning.
Supplemental: rules that are known to require further environment-specific tuning and tweaking to perform, and are often used for hunting workflows.

Please check back to this GitHub for updates to these rules.

FireEye customers can refer to the FireEye Community (community.fireeye.com) for information on how FireEye products detect these threats.

The entire risk as to quality and performance of these rules is with the users.

Please review the FireEye blog for additional details on this threat.

Please note: COSMICGALE and SUPERNOVA signatures and indicators are confirmed to detect malicious files and activity, however they have not been directly associated with the current UNC2452 Solarwinds compromise.

sunburst_countermeasures's People

Contributors

Stargazers

Watchers

Forkers

hledger pancak3lullz osu-soc daveochoa hzdwang sundancekids jonaskriks caliskanfurkan donbinhvn grajawake xkhahuss friutl bijaylimbu mythreat turki1624 al3zf jawhi lichnak yidaofeiliu fz221b rcanzanese sgnls joshmsimpson scotiejes kpratiksha styxl curtisstarnes thavisoukj0 tenaciousdoo fscc-jamesd heat-miser secanalyst matt-culbert ssingam18 ffroztt zaggwarrior amrandazzo coldsmoke627 yellowxwolf paddylennon rgi-group mzintelligence wacert-dfir chewfabianopaixao zrcarnes phxnetworkjunkie akhandew dukeofdisaster exec-bypass toddherrell vhumint vinhduong ekojs nightescape ericzde darryllane andreasmoe aske1204 jagadishpullappa itsreallynick fpli-mbr reesespcres pivelpin aslamh rdmershon schrodyn ghtali walt1998 davidliu88 plazmaz stealthzerocool johnlatwc l1nuxg4m32 flaing topia01 t0xlc bemitc itayc0hen chandanml snd-gr mr9d011 ehkiden ebujan cory-imel alienzox benny33 beyondcy gitjoven abdulmajeed1 raystyle digihash tdmomega77 justanotheranonymoususer msduketown cephurs abbannddonn identicalosrs monkey-data alexhiggins732 walterjia

sunburst_countermeasures's Issues

ClamAV malformed database for Raw64 dropper

ClamAV seems to experience issues when reading the ruleset from APT_Dropper_Raw64_TEARDROP_1.yar on Ubuntu 18.04.5 LTS. All other Yara rulesets work without issues.

$ clamscan -ir -d APT_Dropper_Raw64_TEARDROP_1.yar /
LibClamAV Error: parse_yara_hex_string: Single byte subpatterns unsupported in ClamAV
LibClamAV Error: load_oneyara: error in parsing yara hex string
LibClamAV Warning: load_oneyara: clamav cannot support 1 input strings, skipping YARA.APT_Dropper_Raw64_TEARDROP_1
LibClamAV Warning: cli_loadyara: problem parsing yara file APT_Dropper_Raw64_TEARDROP_1.yar, yara rule APT_Dropper_Raw64_TEARDROP_1
LibClamAV Error: Can't load APT_Dropper_Raw64_TEARDROP_1.yar: Malformed database
ERROR: Malformed database

----------- SCAN SUMMARY -----------
Known viruses: 0
Engine version: 0.102.4
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 0.006 sec (0 m 0 s)                                                                                                                                                                                                                                                                                                 

$  clamscan --version                                                            
ClamAV 0.102.4/26024/Mon Dec 21 13:48:10 2020

Mistake in snort rule files (matching "T " instead of "GET ")

All snort rules I've taken a look so far use a wrong first match for content:"T "; offset:2; depth:3; that is separately matched to the actual "GET /..." URLs.

A simple "GET /swip/Events" would suffice (as even the HTTP/1 suffix is unnecessary, actually). Depending on the final rule parser and software, some IDS might cause false positive alerts because of this.

Additional hash for SolarWinds.Orion.Core.BusinessLayer.dll

a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc

Beacon Decoder and Passive DNS list

Can we add the links to the Beacon Decoder located here:
https://github.com/RedDrip7/SunBurst_DGA_Decode

With passive DNS data here:
https://github.com/bambenek/research/tree/main/sunburst

Br
Marc

edit: beacon...not bacon...

Please post Redline compatible IOCs

From Redline Support:
The IOCs that you downloaded from FireEye's GitHub site is OpenIOC version 1.1. Redline currently only supports the OpenIOC version 1.0 standard.

OpenIOC 3.2.0 supports OpenIOC version 1.1 format, so that is why you were able to open then in that program.

OpenIOC 1.1 standard is not backward-compatible with 1.0.