Solarwinds SUPERNOVA Webshell Access

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

Detects access attempts to the SUPERNOVA webshell, specifically looking for requests to 'logoimagehandler.ashx' with 'clazz' in the query string, or requests to 'logoimagehandler.ashx' resulting in a 500 HTTP status code. This activity is indicative of an adversary interacting with a deployed webshell.