Forest Blizzard is tracked here as a threat actor, intrusion set, or campaign with 5 Sigma detections spanning 2024. Coverage centers on windows / file_event, windows / registry_set, windows / process_creation.
Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.
Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.
Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.
Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.
Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.