APT29 2018 Phishing Campaign CommandLine Indicators

calendar Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.011 detection.emerging-threats  ·
Share on: linkedin copy

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Sigma rule (View on GitHub)

 1title: APT29 2018 Phishing Campaign CommandLine Indicators
 2id: 7453575c-a747-40b9-839b-125a0aae324b
 3related:
 4    - id: 033fe7d6-66d1-4240-ac6b-28908009c71f
 5      type: obsolete
 6status: stable
 7description: Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant
 8references:
 9    - https://twitter.com/DrunkBinary/status/1063075530180886529
10    - https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
11    - https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign
12author: Florian Roth (Nextron Systems), @41thexplorer
13date: 2018-11-20
14modified: 2023-03-08
15tags:
16    - attack.defense-evasion
17    - attack.execution
18    - attack.t1218.011
19    - detection.emerging-threats
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection:
25        - CommandLine|contains: '-noni -ep bypass $'
26        - CommandLine|contains|all:
27              - 'cyzfc.dat,'
28              - 'PointFunctionCall'
29    condition: selection
30falsepositives:
31    - Unlikely
32level: critical

References

Related rules

to-top