SUNBURST
Software · ATTACK:enterprise:S0559
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0559",
"title": "SUNBURST",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0559",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--a8839c95-029f-44cf-8f3d-a3cf2039e927",
"external_id": "S0559",
"domain": "enterprise",
"created": "2021-01-05T22:42:05.965Z",
"modified": "2023-12-26T19:44:49.643Z",
"version": "2.5",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "SUNBURST"
},
{
"source_name": "Solorigate"
},
{
"source_name": "FireEye SUNBURST Backdoor December 2020",
"url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
},
{
"source_name": "Microsoft Deep Dive Solorigate January 2021",
"url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
},
{
"source_name": "SolarWinds Sunburst Sunspot Update January 2021",
"url": "https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/"
}
]
}Explicit source assertions (38)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0648b4df-ad84-4c94-8a0c-16e392f80f82
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--088f896a-59a4-4bce-aacf-3a1f0d6c4237
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--142afe71-581e-415e-9867-97ac0aaded65
FireEye SUNBURST Backdoor December 2020 · Microsoft Analyzing Solorigate Dec 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15cd99f1-29b4-4603-ae74-fdc204afead4
FireEye SUNBURST Backdoor December 2020 · Microsoft Analyzing Solorigate Dec 2020 · Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28b3fb26-c7f8-481d-8424-895953bfb492
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2db32876-d6f5-4862-b760-f0a9dfb28c3c
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1070.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39080ec2-9914-4f83-a83e-18573da1b776
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5260f605-09d0-4d96-9239-9b93a76d0cbe
Microsoft Analyzing Solorigate Dec 2020 · FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--544e4a14-6aae-4950-8fed-d1246a98ed06
FireEye SUNBURST Backdoor December 2020 · Microsoft Analyzing Solorigate Dec 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6189bf91-d755-47e6-9f3c-dd621e3f64fd
FireEye SUNBURST Backdoor December 2020 · Microsoft Analyzing Solorigate Dec 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64ee123b-bf6f-440f-a34e-6f20838b6f30
FireEye SUNBURST Additional Details Dec 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6de977db-83b0-474e-9e18-4b8f67eb4ddb
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--713fdffc-8955-43d6-b1bd-4515d3ca06a6
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1546.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78fce2a1-4d92-4e67-8e9b-c684f33b4536
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--797a925e-7fe8-4d88-a372-88160f24b111
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c9d93d6-c50a-4f6c-8b1d-965ebbdcc268
Microsoft Analyzing Solorigate Dec 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e2ceab5-e5ae-4c79-aceb-424d42703e5f
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81f979db-6420-4686-9239-085ff2a8cc53
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9234553d-b096-418f-b3d0-de75c15d8180
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--988f5b4b-bfc7-4714-b6f0-f753c0472cab
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1001.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac71c15a-3c61-4e73-9663-fb35dc0a1a66
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1001.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ade42bce-dfa6-4a34-8a42-dad089debbd0
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b59f580e-526d-4f80-bf8a-5fed0a5f2f51
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6a60179-abb0-41ec-96cc-112abe232509
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0559
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bdc492d0-220c-4588-8361-a92dc79c4ba0
CheckPoint Sunburst & Teardrop December 2020 · FireEye SUNBURST Backdoor December 2020 · Microsoft Deep Dive Solorigate January 2021 · FireEye SUNBURST Additional Details Dec 2020 · SolarWinds Sunburst Sunspot Update January 2021 · Symantec Sunburst Sending Data January 2021ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--beeabdd2-deb3-43fc-b7d4-884f078271a1
FireEye SUNBURST Backdoor December 2020 · Microsoft Analyzing Solorigate Dec 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1070.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf19c419-8736-4a1f-83cf-23ba5438ad4c
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c911e8d7-be27-48cf-8f5a-0be56cbe6592
Microsoft Analyzing Solorigate Dec 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cedfb953-2088-4e8d-a21b-57fdfce65337
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf32330f-0d67-4e10-adae-2fe3157f6888
Microsoft Analyzing Solorigate Dec 2020 · FireEye SUNBURST Additional Details Dec 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9089fda-0f17-43d2-bd5b-b9cd441bb4e2
FireEye SUNBURST Backdoor December 2020 · Microsoft Analyzing Solorigate Dec 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e83fb711-3ce0-4c6a-a8b2-0efb96551b99
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1027.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e88a2959-311f-40c9-adc9-895f38bb1dd7
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ecc31d1c-b5ac-4458-b379-a5c003637ee2
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f01cbea5-8528-45e8-afdf-d1f382980d8a
FireEye SUNBURST Backdoor December 2020 · FireEye SUNBURST Additional Details Dec 2020 · Symantec Sunburst Sending Data January 2021ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0559
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5e2c4ef-fe56-416e-8d74-733272c7310b
FireEye SUNBURST Backdoor December 2020 · MSTIC NOBELIUM May 2021 · Secureworks IRON RITUAL ProfileATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f974cb59-0c30-43a3-bb3e-58ebc1007d6d
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fed38133-26a9-44e3-b57d-9d415aaeaf84
Microsoft Deep Dive Solorigate January 2021