MITRE ATT&CKsoftware (malware)

S0559 SUNBURST

Published 2021-01-05 Modified 2023-12-26 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Solorigate
Version
2.5
Created
2021-01-05

Description

SUNBURST is a trojanized DLL designed to fit within the SolarWinds Orion software update framework. It was used by APT29 since at least February 2020.

Related

Uses · MITRE ATT&CK (36)

  • T1685 Disable or Modify Tools technique
  • T1027.015 Compression sub-technique
  • T1070.009 Clear Persistence sub-technique
  • T1070.007 Clear Network Connection History and Configurations sub-technique
  • T1027.005 Indicator Removal from Tools sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1001.001 Junk Data sub-technique
  • T1001.002 Steganography sub-technique
  • T1001.003 Protocol or Service Impersonation sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.004 DNS sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1568 Dynamic Resolution technique
  • T1059.005 Visual Basic sub-technique
  • T1497.001 System Checks sub-technique
  • T1497.003 Time Based Checks sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1553.002 Code Signing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1546.012 Image File Execution Options Injection sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1005 Data from Local System technique
  • T1007 System Service Discovery technique
  • T1012 Query Registry technique
  • T1016 System Network Configuration Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1033 System Owner/User Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1057 Process Discovery technique
Show all 36 ›

Referenced by MITRE ATT&CK · uses (2)

  • C0024 SolarWinds Compromise campaign
  • G0016 APT29 group

References