Hayabusa medium test sigma

Forest Blizzard APT - JavaScript Constrained File Creation

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

View Source

Detection Logic

{
  "file_event": {
    "EventID": 11,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "TargetFilename
| startswith": "C:\\Windows\\System32\\DriverStore\\FileRepository\\",
    "TargetFilename
| endswith": "\\.js"
  },
  "condition": "file_event and selection"
}

False Positives

⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...