Forest Blizzard APT - Custom Protocol Handler Creation

 1title: Forest Blizzard APT - Custom Protocol Handler Creation
 2id: 5cdeb555-65de-4767-99fe-e26807465148
 3status: test
 4description: |
 5    Detects the setting of a custom protocol handler with the name "rogue".
 6    Seen being created by Forest Blizzard APT as reported by MSFT.    
 7references:
 8    - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2024-04-23
11tags:
12    - attack.privilege-escalation
13    - attack.persistence
14    - attack.t1547.001
15    - detection.emerging-threats
16logsource:
17    category: registry_set
18    product: windows
19detection:
20    selection:
21        TargetObject|contains: '\PROTOCOLS\\Handler\rogue\CLSID'
22        Details: '{026CC6D7-34B2-33D5-B551-CA31EB6CE345}'
23    condition: selection
24falsepositives:
25    - Unlikely
26level: high