Forest Blizzard APT - Custom Protocol Handler Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

Detects the creation or modification of a custom protocol handler in the Windows Registry with the name "rogue" and a specific CLSID. This activity has been observed as a persistence mechanism used by the Forest Blizzard APT group (also known as Star Blizzard or COLDRIVER). By setting a custom protocol handler, the adversary can execute arbitrary code when a specially crafted URI is accessed.