solarwinds-sunburst-supply-chain-attack/
├── README.md                     # overview
├── analysis.md                   # full writeup                                    
├── references.md                 # annotated sources organized by category
│ 
└── poc/                          # poc scripts
    │
    │ 
    ├── scan_orion.sh             # Linux/macOS IOC scanner 
    │
    │                             
    ├── check_dll_hash.ps1        # Windows PowerShell verifier 
    │                                
    │                                
    ├── sunburst_dns_sim.py       # Python demo of the DNS subdomain encoding
    │                                cipher 
    │                                
    └── detect_golden_saml.md     # Cloud pivot detection guide with KQL, PowerShell,
                                     and Splunk queries for ADFS/Azure AD forensics