APT29 2018 Phishing Campaign File Indicators

 1title: APT29 2018 Phishing Campaign File Indicators
 2id: 3a3f81ca-652c-482b-adeb-b1c804727f74
 3related:
 4    - id: 7453575c-a747-40b9-839b-125a0aae324b # ProcessCreation
 5      type: derived
 6status: stable
 7description: Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant
 8references:
 9    - https://twitter.com/DrunkBinary/status/1063075530180886529
10    - https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign
11author: '@41thexplorer'
12date: 2018-11-20
13modified: 2023-02-20
14tags:
15    - attack.defense-evasion
16    - attack.t1218.011
17    - detection.emerging-threats
18logsource:
19    product: windows
20    category: file_event
21detection:
22    selection:
23        TargetFilename|contains:
24            - 'ds7002.lnk'
25            - 'ds7002.pdf'
26            - 'ds7002.zip'
27    condition: selection
28falsepositives:
29    - Unlikely
30level: critical

References

• x.com

  
  Read More

• Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant | Google Cloud Blog

  

  The attacker appears to have compromised the email server of a hospital and the corporate website of a consulting company in order to use their infrastructure to send phishing emails. The phishing ...

  
  Read More

Related rules

• APT29 2018 Phishing Campaign CommandLine Indicators
• Equation Group DLL_U Export Function Load
• EvilNum APT Golden Chickens Deployment Via OCX Files
• Fireball Archer Install
• IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32