Forest-Blizzard

Forest Blizzard APT - Custom Protocol Handler Creation

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.

Forest Blizzard APT - File Creation Activity

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.

Forest Blizzard APT - JavaScript Constrained File Creation

Aug 12, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

Forest Blizzard APT - Process Creation Activity

Aug 12, 2024 · attack.defense-evasion attack.execution ·

Share on:

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.