Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

Detects the setting of a DLL that handles a custom protocol handler, specifically targeting a CLSID observed in attacks attributed to Forest Blizzard APT. This technique can be used for persistence or privilege escalation by registering a malicious DLL to be loaded when a specific protocol is invoked.