Forest Blizzard APT - JavaScript Constrained File Creation

 1title: Forest Blizzard APT - JavaScript Constrained File Creation
 2id: ec7c4e9b-9bc9-47c7-a32f-b53b598da642
 3status: experimental
 4description: |
 5    Detects the creation of JavaScript files inside of the DriverStore directory.
 6    Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.    
 7references:
 8    - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2024/04/23
11tags:
12    - attack.defense_evasion
13    - attack.t1562.002
14logsource:
15    category: file_event
16    product: windows
17detection:
18    selection:
19        TargetFilename|startswith: 'C:\Windows\System32\DriverStore\FileRepository\'
20        TargetFilename|endswith: '\.js'
21    condition: selection
22falsepositives:
23    - Unlikely
24level: medium