Spearphishing ZIP/LNK Delivery of Nested _CL_ Folder Loader Triad
Detects file-system artifacts from JadeProx spearphishing delivery. The nested _CL_###### staging folder path is treated as the primary, high-confidence indicator on its own. Campaign decoy archive names (Estado de Cuenta.zip, Claude-Pro-Relay-Technical-Overview.zip) are generic business-document-style names that could coincide with unrelated legitimate files, so they only trigger the rule when accompanied by evidence of an LNK shortcut in the same drop (the shared JadeProx LNK machine ID desktop-47cf5k7, or a generic .lnk file) staging the TriBack Loader triad and decoy document.
Sigma
