APT29 2018 Phishing Campaign File Indicators

 1title: APT29 2018 Phishing Campaign File Indicators
 2id: 3a3f81ca-652c-482b-adeb-b1c804727f74
 3related:
 4    - id: 7453575c-a747-40b9-839b-125a0aae324b # ProcessCreation
 5      type: derived
 6status: stable
 7description: Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant
 8references:
 9    - https://twitter.com/DrunkBinary/status/1063075530180886529
10    - https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign
11author: '@41thexplorer'
12date: 2018/11/20
13modified: 2023/02/20
14tags:
15    - attack.defense_evasion
16    - attack.t1218.011
17    - detection.emerging_threats
18logsource:
19    product: windows
20    category: file_event
21detection:
22    selection:
23        TargetFilename|contains:
24            - 'ds7002.lnk'
25            - 'ds7002.pdf'
26            - 'ds7002.zip'
27    condition: selection
28falsepositives:
29    - Unlikely
30level: critical

References

• Something went wrong, but don’t fret — let’s give it another shot.

  
  Read More

• Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant

  

  Introduction FireEye devices detected intrusion attempts against multiple industries, including think tank, law enforcement, media, U.S. military, imagery, transportation, pharmaceutical, national ...

  
  Read More

Related rules

• APT29 2018 Phishing Campaign CommandLine Indicators
• Rhadamanthys Stealer Module Launch Via Rundll32.EXE
• NotPetya Ransomware Activity
• Equation Group DLL_U Export Function Load
• Potential Emotet Rundll32 Execution