We use cookies to improve your experience. Do you accept?

Cyware's SOAR Response Workflow for SUNBURST Attack

Cyware's SOAR Response Workflow for SUNBURST Attack - Featured Image

Cyware Fusion and Threat Response (CFTR) • Jan 4, 2021

Over the last several days, the malware tracked by several names including Solorigate and SUNBURST is being used in a widespread campaign termed UNC2452. The campaign is believed to have launched supply chain attacks against a large number of organizations. This has necessitated every SOC team in the world to detect any signs of this malware being present in their systems and implement preventive and mitigation measures.

Following is a workflow, created by Cyware, implemented as Automated Playbook on the Cyware Security Orchestration Layer (CSOL) to supplement analysts in detecting, preventing, and reacting faster to the looming threat.

The playbook integrates with the following (category of) tools to perform various actions like blocking of IOCs, creation of support tickets on ITSM.

Detailed Workflow

Cyware’s Threat Intelligence eXchange platform (CTIX) acts as the source of information for this workflow. It collects threat data coming in from various structured and unstructured sources such as FireEye Threat Feeds, reports published by different agencies across the world, and others.

These threat feeds are then categorized and stored separately as Indicators of Compromise (IOCs), Vulnerabilities, and other SDOs. This threat data, if related to SUNBURST malware, is passed on to CSOL for actioning.

The Playbook Performs the Following Tasks:

Containment

  • Quarantine compromised assets through possible solutions (AV/EDR)

  • Kill malicious process(es) running on the compromised endpoints (EDR)

Enrichment

  • Enrich unknown hashes found through EDR associated/connecting with known IOCs/IOAs

Mitigation

  • Add identified IOCs/IOAs to the SIEM Reference list for future detections.

  • Block the indicators on the respective solution(s) as per the type of the indicator i.e. Domain/URL on Proxy, IP on Firewall, hashes on AV/EDR, and others.

  • Add any newly identified indicators to CTIX/TIP

  • Deploy the Yara signatures on IPS/IDS devices.

Response and Remediation

  • Run a malware hunt on EDR technology to identify compromised assets.

  • Run a search query on SIEM for other log traces of compromise.

  • Take a snapshot/memory dump of the endpoint.

  • Create Incidents/Requests for compromised assets for Digital Forensics and Incident Response.

  • Notify appropriate stakeholders with Incident details and suggested actions via CSAP and/or Email.

  • Search assets with identified Vulnerabilities using Vulnerability Management System (VMS).

  • Create priority patching requests for assets with identified Vulnerability (VMS).

Please refer to our Github Repo for the centralized tracking of all action items for defenders.

Related Blogs

Implement a Requirements-Driven Approach to Your Threat Intelligence Lifecycle - Featured Image

Implement a Requirements-Driven Approach to Your Threat Intelligence Lifecycle

What intelligence to collect? What intelligence to analyze? What intelligence to share? If security teams do not have the right answers to these questions, the

Cyware Situational Awareness Platform (CSAP)Intelligence RequirementsPIRCollaborate
Creating Incident Workflows at Scale is Now Easy with Cyware - Featured Image

Creating Incident Workflows at Scale is Now Easy with Cyware

[MSSPs](https://cyware.com/blog/cywares-new-multi-tenancy-dashboard-enables-mssps-to-gain-threat-visibility-across-customer-environments-aef0) spend a lot of ti

Cyware Fusion and Threat Response (CFTR)Import workflowsExport workflowsCFTR tenants
Visualize and Map Global Security Incidents in Real Time - Featured Image

Visualize and Map Global Security Incidents in Real Time

Geographical awareness plays an important role in the planning and execution of an effective incident response, helping incident responders understand the locat

Cyware Fusion and Threat Response (CFTR)Geo-mapping
Cyware Threat Intelligence Lite Platform Now Available on AWS Marketplace - Featured Image

Cyware Threat Intelligence Lite Platform Now Available on AWS Marketplace

We are pleased to announce another milestone for Cyware, with the release and immediate availability of the [Intel Exchange (CTIX Lite)](https://aws.amazon.com/

Cyware Threat Intelligence Exchange (CTIX)AWS MarketplaceCTIX Lite
Traffic Light Protocol (TLP) 2.0 Threat Intel Sharing Standard Now Available for Cyware Customers - Featured Image

Traffic Light Protocol (TLP) 2.0 Threat Intel Sharing Standard Now Available for Cyware Customers

In modern security operations, security teams and decision-makers at various levels constantly communicate and collaborate by sharing threat intelligence over v

Traffic Light Protocol (TLP)Cyware Situational Awareness Platform (CSAP)Threat Intel SharingTLP 2.0
Don’t Miss Any Critical Task in Incident Response! Auto-Create Actions Now. - Featured Image

Don’t Miss Any Critical Task in Incident Response! Auto-Create Actions Now.

When an incident occurs, security teams create and define actions manually, which increases their [mean time to respond (MTTR)](https://cyware.com/educational-g

Cyware Fusion and Threat Response (CFTR)CFTRUse CaseAction library
Information Sharing for Incident Response Teams is Now Easy with Cyware’s Slack Integration - Featured Image

Information Sharing for Incident Response Teams is Now Easy with Cyware’s Slack Integration

With more security teams working remotely than ever before, team collaboration and communication often become patchy. In our latest release, we have integ

Slack IntegrationCyware Fusion and Threat Response (CFTR)CFTRUse Case
Connect the Dots with Cyware For a Faster Threat Investigation Process - Featured Image

Connect the Dots with Cyware For a Faster Threat Investigation Process

Threat investigation requires unearthing of complex hidden patterns, more so importantly in present times when threat actors have become highly advanced and are

Cyware Fusion and Threat Response (CFTR)Threat InvestigationUse Caseconnect the dots
Gain 360-Degree Insights into Threat Data with Cyware’s Revamped Threat Data Capabilities - Featured Image

Gain 360-Degree Insights into Threat Data with Cyware’s Revamped Threat Data Capabilities

If security teams fail to gain the required context from the ingested threat data for predicting and preempting threats, then such threat data is meaningless. W

Use CaseThreat DataCyware Threat Intelligence Exchange (CTIX)
Accelerate Investigation and Build Contextualized Threat Intel with Cyware Threat Intelligence eXchange - Featured Image

Accelerate Investigation and Build Contextualized Threat Intel with Cyware Threat Intelligence eXchange

Security teams often face challenges with the structured investigation, absence of team collaboration, and unorganized threat data. The [Cyware Threat Intellige

Threat InvestigationsCyware Threat Intelligence Exchange (CTIX)
Reinforce Threat Investigation Data with Interactive Threat Bulletins - Featured Image

Reinforce Threat Investigation Data with Interactive Threat Bulletins

Threat Bulletins enable security teams and stakeholders to make smarter business decisions while helping them keep pace with the evolving threat landscape. The

Threat BulletinsCyware Threat Intelligence Exchange (CTIX)
Manage Dynamic Workflows with Cyware’s Enhanced Incident Module - Featured Image

Manage Dynamic Workflows with Cyware’s Enhanced Incident Module

For different incidents, organizations often follow the same workflows. The different processes involved in an incident response lifecycle require different fra

Cyware Fusion and Threat Response (CFTR)