Sunburst Correlation DLL and Network Event

SPLUNK detection rule by Patrick Bareiss, Splunk · Apache-2.0

The following analytic identifies the loading of the malicious SolarWinds.Orion.Core.BusinessLayer.dll by SolarWinds.BusinessLayerHost.exe and subsequent DNS queries to avsvmcloud.com. It uses Sysmon EventID 7 for DLL loading and Event ID 22 for DNS queries, correlating these events within a 12-14 day period. This activity is significant as it indicates potential Sunburst malware infection, a known supply chain attack. If confirmed malicious, this could lead to unauthorized network access, data exfiltration, and further compromise of the affected systems.

name: Sunburst Correlation DLL and Network Event
id: 701a8740-e8db-40df-9190-5516d3819787
version: 11
creation_date: '2020-12-14'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: experimental
type: TTP
description: The following analytic identifies the loading of the malicious SolarWinds.Orion.Core.BusinessLayer.dll by SolarWinds.BusinessLayerHost.exe and subsequent DNS queries to avsvmcloud.com. It uses Sysmon EventID 7 for DLL loading and Event ID 22 for DNS queries, correlating these events within a 12-14 day period. This activity is significant as it indicates potential Sunburst malware infection, a known supply chain attack. If confirmed malicious, this could lead to unauthorized network access, data exfiltration, and further compromise of the affected systems.
data_source:
    - Sysmon EventID 7
    - Sysmon EventID 22
search: |-
    `sysmon`
    (
        EventCode=7
        ImageLoaded=*SolarWinds.Orion.Core.BusinessLayer.dll
    )
    OR
    (
        EventCode=22
        QueryName=*avsvmcloud.com
    )
    | eventstats dc(EventCode) AS dc_events
    | where dc_events=2
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
        by Image ImageLoaded dest
           loaded_file loaded_file_path original_file_name
           process_exec process_guid process_hash
           process_id process_name process_path
           service_dll_signature_exists service_dll_signature_verified signature
           signature_id user_id vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `sunburst_correlation_dll_and_network_event_filter`
how_to_implement: This detection relies on sysmon logs with the Event ID 7, Driver loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. We suggest to run this detection at least once a day over the last 14 days.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mandiant.com/resources/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
finding:
    title: Possible Sunburst activity on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - NOBELIUM Group
asset_type: Windows
mitre_attack_id:
    - T1203
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

04dd5d57-2e7f-40bb-be10-281ae55962f1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion