nobelium_group.yml

name: NOBELIUM Group
id: 758196b5-2e21-424f-a50c-6e421ce926c2
version: 2
date: '2020-12-14'
author: Patrick Bareiss, Michael Haag, Splunk
description: Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and
  management software. It was discovered by FireEye in December 2020. The actors behind
  this campaign gained access to numerous public and private organizations around
  the world.
narrative: This Analytic Story supports you to detect Tactics, Techniques and Procedures
  (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll,
  is a SolarWinds digitally-signed component of the Orion software framework that
  contains a backdoor that communicates via HTTP to third party servers. The detections
  in this Analytic Story are focusing on the dll loading events, file create events
  and network events to detect This malware.
references:
- https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
tags:
  analytic_story: NOBELIUM Group
  category:
  - Adversary Tactics
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  usecase: Advanced Threat Detection