Detect the SUNBURST malware

For the final challenge you must write two YARA rules for the SUNBURST malware. This is a complicated piece of trojanized legitimate software, used in a “supply chain” attack. There are a number of public resources and YARA rules surrounding SUNBURST that you can use as starting points to help understand the static detection surface area and to help identify interesting file content for YARA rules. For this challenge, you and seek to leverage the dotnet module in all rules. (Hint: print module data first!)


Reading on SUNBURST:


https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
https://www.mandiant.com/resources/blog/sunburst-additional-technical-details
https://github.com/mandiant/sunburst_countermeasures/tree/main/rules/SUNBURST/yara

Write two YARA rules to detect the infamous SUNBURST malware using YARA's dotnet module in some way.

Sha256 of sample: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134

Zip of sample: https://drive.google.com/file/d/19NVU8ggc858litfuTb-B8kITNrDsQCts/view?usp=share_link

Password of zip: infected