Forest Blizzard APT - JavaScript Constrained File Creation

 1title: Forest Blizzard APT - JavaScript Constrained File Creation
 2id: ec7c4e9b-9bc9-47c7-a32f-b53b598da642
 3status: test
 4description: |
 5    Detects the creation of JavaScript files inside of the DriverStore directory.
 6    Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.    
 7references:
 8    - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2024-04-23
11tags:
12    - attack.defense-evasion
13    - attack.t1562.002
14    - detection.emerging-threats
15logsource:
16    category: file_event
17    product: windows
18detection:
19    selection:
20        TargetFilename|startswith: 'C:\Windows\System32\DriverStore\FileRepository\'
21        TargetFilename|endswith: '\.js'
22    condition: selection
23falsepositives:
24    - Unlikely
25level: medium