huntrule

Windows Process Creation: Detects Specific Forest Blizzard Tool Execution via Hashes and Batch/Schtasks Patterns

Detects suspicious Windows process execution tied to known hashes or schtasks/PowerShell command-line patterns used for staging and compression.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Detects Specific Forest Blizzard Tool Execution via Hashes and Batch/Schtasks Patterns"
id: e060e418-b441-4c53-84d7-8039795c9675
status: experimental
description: This rule flags Windows process creation events that match either one of two specific SHA256 hashes or a targeted execution pattern involving schtasks.exe creating/deleting tasks in the Microsoft\Windows\WinSrv path. It also detects PowerShell command lines that perform file discovery, write a .save artifact, and compress output to C:\ProgramData\ using Compress-Archive. Such behavior matters because attackers may stage, persist, and archive data using batch scripts, scheduled tasks, and PowerShell-based collection. Telemetry relies on Windows process creation details including process image path, full command line, and SHA256 file hash when available.
references:
  - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/proc_creation_win_apt_forest_blizzard_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-23
modified: 2025-01-22
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_hashes:
    Hashes|contains:
      - SHA256=6b311c0a977d21e772ac4e99762234da852bbf84293386fbe78622a96c0b052f
      - SHA256=c60ead92cd376b689d1b4450f2578b36ea0bf64f3963cfa5546279fa4424c2a5
  selection_schtasks_create:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - Create
      - /RU
      - SYSTEM
      - \Microsoft\Windows\WinSrv
    CommandLine|contains:
      - servtask.bat
      - execute.bat
      - doit.bat
  selection_schtasks_delete:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - Delete
      - "/F "
      - \Microsoft\Windows\WinSrv
  selection_powershell:
    CommandLine|contains|all:
      - Get-ChildItem
      - .save
      - Compress-Archive -DestinationPath C:\ProgramData\
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 07db928c-8632-488e-ac7d-3db847489175
    type: derived

What it detects

This rule flags Windows process creation events that match either one of two specific SHA256 hashes or a targeted execution pattern involving schtasks.exe creating/deleting tasks in the Microsoft\Windows\WinSrv path. It also detects PowerShell command lines that perform file discovery, write a .save artifact, and compress output to C:\ProgramData\ using Compress-Archive. Such behavior matters because attackers may stage, persist, and archive data using batch scripts, scheduled tasks, and PowerShell-based collection. Telemetry relies on Windows process creation details including process image path, full command line, and SHA256 file hash when available.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.