RisingSun: Decoding SUNBURST C2 to Identify Infected…
ID: e70541b1-d176-5865-b335-a0af77254af5
STIX ID: report--e70541b1-d176-5865-b335-a0af77254af5
Feed Name: TrustedSec blog
Threat Score
This report outlines analysis of the SUNBURST/SolarWinds supply-chain compromise, explains how the backdoor generates Host IDs and C2 domains, and introduces RisingSun — a Go tool that reproduces Host IDs from host data (MAC, AD domain, MachineGuid) to match and attribute SUNBURST C2 domains to specific hosts to support investigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.