
title: Unidentified Attacker November 2018
author: '@41thexplorer, Microsoft Defender ATP'
date: 2018/11/20
description: A sigma rule detecting an unidetefied attacker who used phishing emails
  to target high profile orgs on November 2018. The Actor shares some TTPs with YYTRIUM/APT29
  campaign in 2016.
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine: '*cyzfc.dat,*'
  SELECTION_3:
    CommandLine: '*PointFunctionCall'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
id: 7453575c-a747-40b9-839b-125a0aae324b
level: high
logsource:
  category: process_creation
  product: windows
modified: 2021/09/19
references:
- https://twitter.com/DrunkBinary/status/1063075530180886529
status: stable
tags:
- attack.execution
- attack.t1218.011
- attack.t1085
ruletype: SIGMA
