Forest Blizzard APT - File Creation Activity

 1title: Forest Blizzard APT - File Creation Activity
 2id: b92d1d19-f5c9-4ed6-bbd5-7476709dc389
 3status: experimental
 4description: |
 5    Detects the creation of specific files inside of ProgramData directory.
 6    These files were seen being created by Forest Blizzard as described by MSFT.    
 7references:
 8    - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2024/04/23
11tags:
12    - attack.defense_evasion
13    - attack.t1562.002
14logsource:
15    category: file_event
16    product: windows
17detection:
18    selection_programdata_driver_store:
19        TargetFilename|startswith:
20            - 'C:\ProgramData\Microsoft\v'
21            - 'C:\ProgramData\Adobe\v'
22            - 'C:\ProgramData\Comms\v'
23            - 'C:\ProgramData\Intel\v'
24            - 'C:\ProgramData\Kaspersky Lab\v'
25            - 'C:\ProgramData\Bitdefender\v'
26            - 'C:\ProgramData\ESET\v'
27            - 'C:\ProgramData\NVIDIA\v'
28            - 'C:\ProgramData\UbiSoft\v'
29            - 'C:\ProgramData\Steam\v'
30        TargetFilename|contains:
31            - '\pnms003.inf_'
32            - '\pnms009.inf_'
33    selection_programdata_main:
34        TargetFilename|startswith: 'C:\ProgramData\'
35    selection_programdata_files_1:
36        TargetFilename|endswith:
37            - '.save'
38            - '\doit.bat'
39            - '\execute.bat'
40            - '\servtask.bat'
41        # Hashes|contains: '7d51e5cc51c43da5deae5fbc2dce9b85c0656c465bb25ab6bd063a503c1806a9' # Uncommon this if you collect hash information inf file events
42    selection_programdata_files_2:
43        TargetFilename|contains: '\wayzgoose'
44        TargetFilename|endswith: '.dll'
45    condition: selection_programdata_driver_store or (selection_programdata_main and 1 of selection_programdata_files_*)
46falsepositives:
47    - Unlikely
48level: high