Sigma rule: Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

Rule

Title

Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2024-04-23

File

rules-emerging-threats/2024/TA/Forest-Blizzard/registry_set_apt_forest_blizzard_custom_protocol_handler_dll.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the setting of the DLL that handles the custom protocol handler.
Seen being created by Forest Blizzard APT as reported by MSFT.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: '\CLSID\{026CC6D7-34B2-33D5-B551-CA31EB6CE345}\Server'
    Details|endswith: '.dll'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1547.001
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1547.001

References

• https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2024/TA/Forest-Blizzard/registry_set_apt_forest_blizzard_custom_protocol_handler_dll.yml