Forest Blizzard APT - File Creation Activity in ProgramData
Detects the creation of specific files within the ProgramData directory that have been observed in campaigns by the Forest Blizzard APT group (also known as Star Blizzard, SEABORGIUM, Callisto Group, TA446, COLDRIVER). These files include those with names like 'prnms003.inf_', 'prnms009.inf_', '.save', 'doit.bat', 'execute.bat', 'servtask.bat', and '.dll' files containing 'wayzgoose', often found in subdirectories under common vendor names within ProgramData.
Sigma
