hightestEmerging Threat
Forest Blizzard APT - File Creation Activity
Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.
windowsfile_event
2024-07-11
Rule Library
Sigma Rules
Browse detections by severity and log source, with YAML and sample events one click away.
3,782Total
3,164Detection
474Emerging
141Hunting
mediumtestEmerging Threat
Forest Blizzard APT - JavaScript Constrained File Creation
Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.
windowsfile_event
2024-04-23
highexperimentalEmerging Threat
Forest Blizzard APT - Process Creation Activity
Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.
windowsprocess_creation
2025-01-22
hightestEmerging Threat
Forest Blizzard APT - Custom Protocol Handler Creation
Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.
windowsregistry_set
2024-04-23
hightestEmerging Threat
Forest Blizzard APT - Custom Protocol Handler DLL Registry Set
Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.
windowsregistry_set
2024-04-23