Threat video1:00
SUNBURST and Shai-Hulud Supply Chain: Detection & IOCs
Traces six supply chain attacks from CCleaner to Shai-Hulud: 27 IOCs, 9 detection rules, 13 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for SUNBURST and Shai-Hulud Supply Chain: Detection & IOCs →
Chapters
- 0:00The hookSix attacks hijacked software distribution.
- 0:04The storyAttackers compromised six major vendors.
- 0:10Attack pathAttackers target vendors: build pipelines, signed releases, scripts.
- 0:26AttributionAttributed to REvil.
- 0:31Indicators of compromise23 indicators to hunt: 7 IPs, 5 domains and 1 URL, and more.
- 0:38MITRE ATT&CK techniques13 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation3 steps now: Hunt for the IOCs in this record.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Six attacks hijacked software distribution.
0:05Attackers compromised six major vendors. Supply chain became the target.
0:11Attackers target vendors: build pipelines, signed releases, scripts.
0:15Millions trust the updates downstream.
0:18Malware runs, beacons home, steals secrets.
0:21Data exfiltrated, worm republished to npm.
0:27Attributed to REvil. Confidence: medium.
0:3123 indicators to hunt: 7 IPs, 5 domains and 1 URL, and more.
0:3813 ATT&CK techniques, from initial access to command and control.
0:443 steps now: Hunt for the IOCs in this record.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.