SolarWinds SUPERNOVA Webshell Access via logoimagehandler.ashx Requests

title: SolarWinds SUPERNOVA Webshell Access via logoimagehandler.ashx Requests
id: 29a42654-427f-4daf-b835-f2fdab0080b9
status: test
description: This rule flags webserver requests targeting SUPERNOVA webshell behavior by matching specific URL query patterns associated with logoimagehandler.ashx and the presence of the 'clazz' parameter. Attackers can use this type of access to establish or interact with server-side persistence mechanisms, making it a high-signal indicator for compromise. It relies on webserver HTTP telemetry fields including the request URI query string and, in one case, an HTTP 500 response status.
references:
  - https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/
  - https://www.anquanke.com/post/id/226029
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/web_solarwinds_supernova_webshell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-12-17
modified: 2023-01-02
tags:
  - attack.persistence
  - attack.t1505.003
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection1:
    cs-uri-query|contains|all:
      - logoimagehandler.ashx
      - clazz
  selection2:
    cs-uri-query|contains: logoimagehandler.ashx
    sc-status: 500
  condition: selection1 or selection2
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: a2cee20b-eacc-459f-861d-c02e5d12f1db
    type: derived