APT29 2018 Phishing Campaign Command Line Indicators

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•32

Detects command-line indicators associated with the APT29 (Cozy Bear) 2018 phishing campaign, specifically looking for PowerShell execution with '-noni -ep bypass' and the presence of 'cyzfc.dat' and 'PointFunctionCall' in the command line. These indicators are linked to the group's methods for executing malicious code and potentially bypassing security measures.