Windows JavaScript file creation in DriverStore FileRepository
Alerts on creation of .js files under DriverStore\FileRepository based on the target path in Windows file events.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-04-23
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies creation of JavaScript files within the Windows DriverStore FileRepository path. Attackers may use constrained scripting and system-associated directories to stage or execute payloads during post-compromise activity. This rule relies on file event telemetry capturing the created file path (TargetFilename) with a specific directory prefix and a .js suffix.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_constrained_js.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows JavaScript file creation in DriverStore FileRepository
id: edc9c660-0a68-42d2-ae92-d10efd94c565
status: test
description: Identifies creation of JavaScript files within the Windows DriverStore FileRepository path. Attackers may use constrained scripting and system-associated directories to stage or execute payloads during post-compromise activity. This rule relies on file event telemetry capturing the created file path (TargetFilename) with a specific directory prefix and a .js suffix.
references:
- https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_constrained_js.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-23
tags:
- attack.defense-impairment
- attack.t1685.001
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|startswith: C:\Windows\System32\DriverStore\FileRepository\
TargetFilename|endswith: \.js
condition: selection
falsepositives:
- Unlikely
level: medium
license: DRL-1.1
related:
- id: ec7c4e9b-9bc9-47c7-a32f-b53b598da642
type: derived