SigmaHQ/rules/apt/apt_unidentified_nov_18.yml

---
action: global
title: Unidentified Attacker November 2018
status: stable
description: A sigma rule detecting an unidetefied attacker who used phishing emails to target high profile orgs on November 2018. The Actor shares some TTPs with YYTRIUM/APT29 campaign in 2016.
references:
    - https://twitter.com/DrunkBinary/status/1063075530180886529
author: "@41thexplorer, Windows Defender ATP"
date: 2018/11/20
modified: 2018/12/11
tags:
    - attack.execution
    - attack.t1085
detection:
    condition: 1 of them
level: high
---
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine: '*cyzfc.dat, PointFunctionCall'
---
# Sysmon: File Creation (ID 11)
logsource:
    product: windows
    service: sysmon
detection:
    selection2:
        EventID: 11
        TargetFilename: 
            - '*ds7002.lnk*'
More conversions to the new process_creation logsource 2019-03-05 06:46:53 +00:00			`---`
adding new rules detecting recently active APTs 2018-12-03 07:42:29 +00:00			`action: global`
			`title: Unidentified Attacker November 2018`
			`status: stable`
			`description: A sigma rule detecting an unidetefied attacker who used phishing emails to target high profile orgs on November 2018. The Actor shares some TTPs with YYTRIUM/APT29 campaign in 2016.`
			`references:`
			`- https://twitter.com/DrunkBinary/status/1063075530180886529`
fix: fixed author string (cannot be list according to sigma specs) 2018-12-05 10:44:14 +00:00			`author: "@41thexplorer, Windows Defender ATP"`
adding new rules detecting recently active APTs 2018-12-03 07:42:29 +00:00			`date: 2018/11/20`
Bugfix: wrong field for 4688 process creation events 2018-12-11 15:10:15 +00:00			`modified: 2018/12/11`
adding new rules detecting recently active APTs 2018-12-03 07:42:29 +00:00			`tags:`
			`- attack.execution`
			`- attack.t1085`
			`detection:`
More conversions to the new process_creation logsource 2019-03-05 06:46:53 +00:00			`condition: 1 of them`
adding new rules detecting recently active APTs 2018-12-03 07:42:29 +00:00			`level: high`
			`---`
			`logsource:`
More conversions to the new process_creation logsource 2019-03-05 06:46:53 +00:00			`category: process_creation`
adding new rules detecting recently active APTs 2018-12-03 07:42:29 +00:00			`product: windows`
			`detection:`
More conversions to the new process_creation logsource 2019-03-05 06:46:53 +00:00			`selection1:`
adding new rules detecting recently active APTs 2018-12-03 07:42:29 +00:00			`CommandLine: '*cyzfc.dat, PointFunctionCall'`
			`---`
			`# Sysmon: File Creation (ID 11)`
			`logsource:`
			`product: windows`
			`service: sysmon`
			`detection:`
More conversions to the new process_creation logsource 2019-03-05 06:46:53 +00:00			`selection2:`
adding new rules detecting recently active APTs 2018-12-03 07:42:29 +00:00			`EventID: 11`
			`TargetFilename:`
			`- 'ds7002.lnk'`