Forest Blizzard APT - Process Creation Activity

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•24

Detects the execution of specific processes and command line combinations associated with the Forest Blizzard APT group. This includes the creation and deletion of scheduled tasks using 'schtasks.exe' and PowerShell commands for file operations, as described by Microsoft.