Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

 1title: Forest Blizzard APT - Custom Protocol Handler DLL Registry Set
 2id: d807056b-0e00-4cec-b7f8-b8b7518e382b
 3status: test
 4description: |
 5    Detects the setting of the DLL that handles the custom protocol handler.
 6    Seen being created by Forest Blizzard APT as reported by MSFT.    
 7references:
 8    - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2024-04-23
11tags:
12    - attack.persistence
13    - attack.t1547.001
14    - detection.emerging-threats
15logsource:
16    category: registry_set
17    product: windows
18detection:
19    selection:
20        TargetObject|contains: '\CLSID\{026CC6D7-34B2-33D5-B551-CA31EB6CE345}\Server'
21        Details|endswith: '.dll'
22    condition: selection
23falsepositives:
24    - Unlikely
25level: high

References

• Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials | Microsoft Security Blog

  

  Analysis of Forrest Blizzard's exploitation of the CVE-2022-38028 vulnerability in Windows Print Spooler that allows elevated permissions.

  
  Read More

Related rules

• Forest Blizzard APT - Custom Protocol Handler Creation
• Potential KamiKakaBot Activity - Winlogon Shell Persistence
• Kapeka Backdoor Autorun Persistence
• Leviathan Registry Key Activity
• Potential Ryuk Ransomware Activity