Windows File Event Indicators for ds7002.lnk, ds7002.pdf, and ds7002.zip

title: Windows File Event Indicators for ds7002.lnk, ds7002.pdf, and ds7002.zip
id: 4d5b9d7a-3fb6-4f39-aa55-f4706f2e767c
related:
  - id: 7453575c-a747-40b9-839b-125a0aae324b
    type: derived
  - id: 3a3f81ca-652c-482b-adeb-b1c804727f74
    type: derived
status: stable
description: This rule matches Windows file events where the target filename contains the strings ds7002.lnk, ds7002.pdf, or ds7002.zip. Such specific filenames are often used as phishing payload indicators, and identifying them helps surface suspicious staging or delivery activity on endpoints. The detection relies on file event telemetry that includes the target filename associated with the relevant file operations.
references:
  - https://twitter.com/DrunkBinary/status/1063075530180886529
  - https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT29-CozyBear/file_event_win_apt_cozy_bear_phishing_campaign_indicators.yml
author: "@41thexplorer, Huntrule Team"
date: 2018-11-20
modified: 2023-02-20
tags:
  - attack.stealth
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - ds7002.lnk
      - ds7002.pdf
      - ds7002.zip
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1