APT29 2018 Phishing Campaign File Indicators

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects file indicators associated with a 2018 phishing campaign attributed to APT29 (Cozy Bear), as reported by Mandiant. The rule specifically looks for the creation or modification of files named 'ds7002.lnk', 'ds7002.pdf', or 'ds7002.zip'.