Forest-Blizzard

Forest Blizzard APT - File Creation Activity

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 detection.emerging-threats ·

Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.

Forest Blizzard APT - JavaScript Constrained File Creation

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 detection.emerging-threats ·

Share on:

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

Forest Blizzard APT - Process Creation Activity

Apr 28, 2026 · attack.execution detection.emerging-threats attack.stealth ·

Share on:

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

Forest Blizzard APT - Custom Protocol Handler Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·

Share on:

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·

Share on:

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.