↳ GitHub sourceAnalytics ruleHigh

SUPERNOVA webshell

Description

'Identifies SUPERNOVA webshell based on W3CIISLog data. References: - https://unit42.paloaltonetworks.com/solarstorm-supernova/'

Rule type: Scheduled
Version: 1.0.4
Query frequency: 1d
Query period: 1d
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

AzureMonitor(IIS)

Data types

W3CIISLog

KQL query

Original query, unchanged.

W3CIISLog
| where csMethod == 'GET'
| where isnotempty(csUriStem) and isnotempty(csUriQuery)
| where csUriStem contains "logoimagehandler.ashx"
| where csUriQuery contains "codes" and csUriQuery contains "clazz" and csUriQuery contains "method" and csUriQuery contains "args"
| extend timestamp = TimeGenerated
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(csUserName, "@")[0]), AccountUPNSuffix = tostring(split(csUserName, "@")[1])

Declared entities

AccountHostIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Web Shells Threat Protection/Analytic Rules/Supernovawebshell.yaml ↗
Commit: 9800e51 ↗
Source identifier: 2acc91c3-17c2-4388-938e-4eac2d5894e8

Additional source files 3

Solutions/Web Shells Threat Protection/Analytic Rules/Supernovawebshell.yamlsource ↗Detections/W3CIISLog/Supernovawebshell.yamlmigration-note ↗Solutions/Web Shells Threat Protection/Data/Solution_WebShellsThreatProtection.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.