Windows Process Creation: Forest Blizzard-related hashes and scheduled task activity
Detects suspicious Windows process execution tied to known hashes or schtasks/PowerShell command-line patterns used for staging and compression.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-04-23
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events that match either specific process hash values or scheduled task manipulation via schtasks.exe targeting the Microsoft\Windows\WinSrv task path. It also looks for PowerShell command lines that collect files and create compressed archives in C:\ProgramData\ using .save and Compress-Archive. These behaviors matter because attackers often stage post-compromise activity by persisting or running payloads through scheduled tasks and using PowerShell to package collected data. The detection relies on process creation telemetry including process image, command line, and (when available) process hash values.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/proc_creation_win_apt_forest_blizzard_activity.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Forest Blizzard-related hashes and scheduled task activity"
id: e060e418-b441-4c53-84d7-8039795c9675
status: experimental
description: This rule flags Windows process creation events that match either specific process hash values or scheduled task manipulation via schtasks.exe targeting the Microsoft\Windows\WinSrv task path. It also looks for PowerShell command lines that collect files and create compressed archives in C:\ProgramData\ using .save and Compress-Archive. These behaviors matter because attackers often stage post-compromise activity by persisting or running payloads through scheduled tasks and using PowerShell to package collected data. The detection relies on process creation telemetry including process image, command line, and (when available) process hash values.
references:
- https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/Forest-Blizzard/proc_creation_win_apt_forest_blizzard_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-23
modified: 2025-01-22
tags:
- attack.execution
- detection.emerging-threats
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_hashes:
Hashes|contains:
- SHA256=6b311c0a977d21e772ac4e99762234da852bbf84293386fbe78622a96c0b052f
- SHA256=c60ead92cd376b689d1b4450f2578b36ea0bf64f3963cfa5546279fa4424c2a5
selection_schtasks_create:
Image|endswith: \schtasks.exe
CommandLine|contains|all:
- Create
- /RU
- SYSTEM
- \Microsoft\Windows\WinSrv
CommandLine|contains:
- servtask.bat
- execute.bat
- doit.bat
selection_schtasks_delete:
Image|endswith: \schtasks.exe
CommandLine|contains|all:
- Delete
- "/F "
- \Microsoft\Windows\WinSrv
selection_powershell:
CommandLine|contains|all:
- Get-ChildItem
- .save
- Compress-Archive -DestinationPath C:\ProgramData\
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 07db928c-8632-488e-ac7d-3db847489175
type: derived