sunburst_iocs

List of IOCs derived from CISA STIX feed and FireEye sunburst_countermeasures repository related to SolarWinds "sunburst" supply chain attack

This repo contains:

• A point-in-time download of the Indicators of Compromise provided by the Cybersecurity and Infrastructure Security Agency (CISA) in their STIX feed accompanying alert AA20-352a.
• IOCs derived from the FireEye sunburst_countermeasures GitHub repo

LogRhythm customers are encouraged to use the LogRhythm Threat Intelligence Service TIS to subscribe to the CISA feed rather than use the static CISA lists in this repository. TIS will automatically create lists corresponding to the IOC types and periodically check the CISA feed for updates.

Please see the LogRhythm blog for more information on leveraging LogRhythm to investigate the behavior described in this report.