Sigma Rule: Sophos Firewall Asnarok Malware Campaign

Eugene Tkachenko
Latest posts by Eugene Tkachenko (see all)
WRITTEN BY
Eugene Tkachenko
[post-views]
April 29, 2020 · 2 min read

An emergency security update for Sophos XG Firewall was released this Saturday. The update patches a zero-day SQL injection remote code execution vulnerability that is actively exploited in the wild. It allows cybercriminals to compromise Sophos firewalls via their management interface and deploy Asnarok malware. The Trojan steals the firewall’s license and serial number, user emails, admin’s salted SHA256 hash, and encrypted passwords. To protect your organization from the threat, make sure that automatic installation of hotfixes is enabled on your firewall: https://community.sophos.com/kb/en-us/135415

Our SOC team released Sigma rule based on IOCs available in Sophos’ security advisory. You can use it to find traces of the malware and determine if your XG Firewall was compromised. You can use Uncoder to convert Sigma rule to the detection content for the security platform you have. Also, you can check the rule with all available translation in Threat Detection Marketplace: https://tdm.socprime.com/tdm/info/RN0oGcnrZfoU/HYulvHEB1-hfOQirCe1I/#

Link to Uncoder: https://uncoder.io/

Uncoder user guide is here: https://socprime.com/en/blog/uncoder-io-user-guide/

Sigma:

title: Sophos Firewall Asnarok Malware Campaign (IOC)
status: stable
description: In April 2020, Sophos firewalls were targeting by an actor using a 0-day SQLi exploit to compromise Sophos firewalls via their management interface. The malware delivered has been named “asnarok”.
references:
– https://news.sophos.com/en-us/2020/04/26/asnarok/
author: SOC Prime Team
logsource:
category: any
detection:
keyword:
– ‘736da16da96222d3dfbb864376cafd58239344b536c75841805c661f220072e5’
– ‘a226c6a641291ef2916118b048d508554afe0966974c5ca241619e8a375b8c6b’
– ‘4de3258ebba1ef3638642a011020a004b4cd4dbe8cd42613e24edf37e6cf9d71’
– ‘9650563aa660ccbfd91c0efc2318cf98bfe9092b4a2abcd98c7fc44aad265fda’
– ‘8e9965c2bb0964fde7c1aa0e8b5d74158e37443d857fc227c1883aa74858e985’
– ’31e43ecd203860ba208c668a0e881a260ceb24cb1025262d42e03209aed77fe4′
– ‘/sp/sophos.dat’
– ‘.post_MI’
– ‘filedownloaderserverx.com’
– ‘filedownloaderserver.com’
– ‘updatefileservercross.com’
– ‘43.229.55.44’
– ‘38.27.99.69’
– ‘sophosfirewallupdate.com’
– ‘filedownloaderservers.com’
– ‘ragnarokfromasgard.com’
– ‘sophosenterprisecenter.com’
– ‘sophoswarehouse.com’
– ‘sophosproductupdate.com’
– ‘sophostraining.org’
condition: keyword
falsepositives:
– this rule could trigger on IOC data from threat intelligence feeds
level: critical

 

Was this article helpful?

Like and share it with your peers.
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
Join for Free Book a Meeting

Related Posts

Forest Blizzard (aka Fancy Bear or APT28)
Blog, Latest Threats — 4 min read
Forest Blizzard aka Fancy Bear Attack Detection: russian-backed Hackers Apply a Custom GooseEgg Tool to Exploit CVE-2022-38028 in Attacks Against Ukraine, Western Europe, and North America
Veronika Telychko
UAC-0133 (Sandworm) Reemerges
Blog, Latest Threats — 5 min read
UAC-0133 (Sandworm) Attack Detection: russia-Linked Hackers Aim to Cripple the Information and Communication Systems of 20 Critical Infrastructure Organizations Across Ukraine
Veronika Telychko
UAC-0149
Blog, Latest Threats — 3 min read
UAC-0149 Attacks Ukrainian Defense Forces Using Signal, CVE-2023-38831 Exploits, and COOKBOX Malware
Daryna Olyniychuk