sofacy__apt_c2_domain_communication

rule sofacy__apt_c2_domain_communication {
 meta:
    author = "Alexandr Yampolskyi, SOC Prime"
    description = "Sofacy, Fancy Bear, Pawn Storm, APT-28 domain communication detection.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/wwYjDSZpHAku"
    version = "0.01"
    created = "2017/11/07"
    product = "proxy"
    mitre = "Command and Control, t1071, t1043"

  events:
($selection.target.hostname = "myinvestgroup.com" or $selection.target.hostname = "netmediaresources.com" or $selection.target.hostname = "webviewres.net" or $selection.target.hostname = "adfs.senate.group" or $selection.target.hostname = "adfs-senate.email" or $selection.target.hostname = "adfs-senate.services" or $selection.target.hostname = "adfs.senate.qov.info" or $selection.target.hostname = "chmail.ir.udelivered.tk" or $selection.target.hostname = "webmail-ibsf.org" or $selection.target.hostname = "fil-luge.com" or $selection.target.hostname = "biathlovvorld.com" or $selection.target.hostname = "mail-ibu.eu" or $selection.target.hostname = "fisski.ca" or $selection.target.hostname = "iihf.eu" or $selection.target.hostname = "Cdnverify.net" or $selection.target.hostname = "osce-press.com" or $selection.target.hostname = "electronicfrontierfoundation.org" or $selection.target.hostname = "baltichost.org" or $selection.target.hostname = "checkmalware.org" or $selection.target.hostname = "kavkazcentr.info" or $selection.target.hostname = "login-osce.org" or $selection.target.hostname = "malwarecheck.info" or $selection.target.hostname = "n0vinite.com" or $selection.target.hostname = "nato.nshq.in" or $selection.target.hostname = "natoexhibitionff14.com" or $selection.target.hostname = "novinitie.com" or $selection.target.hostname = "poczta.mon.q0v.pl" or $selection.target.hostname = "q0v.pl" or $selection.target.hostname = "qov.hu.com" or $selection.target.hostname = "rnil.am" or $selection.target.hostname = "scanmalware.info" or $selection.target.hostname = "smigroup-online.co.uk" or $selection.target.hostname = "standartnevvs.com" or $selection.target.hostname = "updatecenter.name" or $selection.target.hostname = "securitypractic.com" or $selection.target.hostname = "drivers-update.info" or $selection.target.hostname = "nato-press.com")

  condition:
    $selection
}