Procedure examples

SUNBURST added junk bytes to its C2 over HTTP.

SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.

SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.

SUNBURST collected information from a compromised host.

SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

SUNBURST collected the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid from compromised hosts.

SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.

SUNBURST obfuscated collected system information using a FNV-1a + XOR algorithm.

SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.

SUNBURST strings were compressed and encoded in Base64.

SUNBURST collected the username from a compromised host.

SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.

SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.

SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

SUNBURST used VBScripts to initiate the execution of payloads.

SUNBURST removed HTTP proxy registry values to clean up traces of execution.

SUNBURST had a command to delete files.

SUNBURST also removed the firewall rules it created during execution.

SUNBURST removed IFEO registry values to clean up traces of persistence.

SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.

SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.

SUNBURST collected hostname and OS version.

SUNBURST had commands to enumerate files and directories.

SUNBURST delivered different payloads, including TEARDROP in at least one instance.

SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.

SUNBURST collected device `UPTIME`.

SUNBURST used Base64 encoding in its C2 traffic.

SUNBURST used Rundll32 to execute payloads.

SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.

SUNBURST remained dormant after initial access for a period of up to two weeks.

SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.

SUNBURST created an Image File Execution Options (IFEO) Debugger registry value for the process dllhost.exe to trigger the installation of Cobalt Strike.

SUNBURST was digitally signed by SolarWinds from March - May 2020.

SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.

SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.

SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.