Sigma rule: Sofacy Trojan Loader Activity

Rule

Title

Sofacy Trojan Loader Activity

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

Date

2018-03-01

Modified

2023-05-31

File

rules-emerging-threats/2018/TA/APT28/proc_creation_win_apt_sofacy.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Trojan loader activity as used by APT28

Log source

product

windows

category

process_creation

Detection

selection_path:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
        - '%LOCALAPPDATA%'
        - '\AppData\Local\'
selection_extensions:
    - CommandLine|contains: '.dat",'
    - CommandLine|endswith:
          - '.dll #1'
          - '.dll" #1'
          - '.dll",#1'
filter_main_exclude_temp:
    CommandLine|contains: '\AppData\Local\Temp\'
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.stealth
• attack.g0007
• attack.t1059.003
• attack.t1218.011
• car.2013-10-002
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• G0007
• T1059.003
• T1218.011

References

• https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
• https://www.hybrid-analysis.com/sample/ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8?environmentId=110
• https://twitter.com/ClearskySec/status/960924755355369472

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2018/TA/APT28/proc_creation_win_apt_sofacy.yml