APT29 2018 Phishing Campaign CommandLine Indicators

 1title: APT29 2018 Phishing Campaign CommandLine Indicators
 2id: 7453575c-a747-40b9-839b-125a0aae324b
 3related:
 4    - id: 033fe7d6-66d1-4240-ac6b-28908009c71f
 5      type: obsoletes
 6status: stable
 7description: Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant
 8references:
 9    - https://twitter.com/DrunkBinary/status/1063075530180886529
10    - https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
11    - https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign
12author: Florian Roth (Nextron Systems), @41thexplorer
13date: 2018/11/20
14modified: 2023/03/08
15tags:
16    - attack.defense_evasion
17    - attack.execution
18    - attack.t1218.011
19    - detection.emerging_threats
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection:
25        - CommandLine|contains: '-noni -ep bypass $'
26        - CommandLine|contains|all:
27              - 'cyzfc.dat,'
28              - 'PointFunctionCall'
29    condition: selection
30falsepositives:
31    - Unlikely
32level: critical

References

• Something went wrong, but don’t fret — let’s give it another shot.

  
  Read More

• https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/

  
  Read More

• Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant

  

  Introduction FireEye devices detected intrusion attempts against multiple industries, including think tank, law enforcement, media, U.S. military, imagery, transportation, pharmaceutical, national ...

  
  Read More

Related rules

• Sofacy Trojan Loader Activity
• Potential Bumblebee Remote Thread Creation
• Fireball Archer Install
• ZxShell Malware
• APT29 2018 Phishing Campaign File Indicators