Windows Process Creation: Match CommandLine Indicators of Cozy Bear 2018 Phishing Tools

title: "Windows Process Creation: Match CommandLine Indicators of Cozy Bear 2018 Phishing Tools"
id: 732f89ad-9a46-4bbc-a021-5152a6b16184
related:
  - id: 033fe7d6-66d1-4240-ac6b-28908009c71f
    type: obsolete
  - id: 7453575c-a747-40b9-839b-125a0aae324b
    type: derived
status: stable
description: This rule flags Windows process creation events where the command line contains specific substrings associated with the 2018 phishing campaign indicators. The matching patterns include a PowerShell-style argument segment and a combination of tokens tied to the suspected payload behavior. It matters because command-line markers can reveal staged execution and tooling used during phishing follow-on activity. The detection relies on process creation telemetry with a populated CommandLine field.
references:
  - https://twitter.com/DrunkBinary/status/1063075530180886529
  - https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
  - https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT29-CozyBear/proc_creation_win_apt_apt29_phishing_campaign_indicators.yml
author: Florian Roth (Nextron Systems), @41thexplorer, Huntrule Team
date: 2018-11-20
modified: 2023-03-08
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains: -noni -ep bypass $
    - CommandLine|contains|all:
        - cyzfc.dat,
        - PointFunctionCall
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1