Modification of IE Registry Settings

SIGMA detection rule by frack113 · GPL-2.0

Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence

title: Modification of IE Registry Settings
id: 0fbb75e3-4f11-c091-e62d-0159f224a0af
related:
    - id: d88d0ab2-e696-4d40-a2ed-9790064e66b3
      type: derived
status: test
description: Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry
author: frack113
date: 2022-01-22
modified: 2025-10-22
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    registry_set:
        EventID: 4657
        Channel: Security
    selection_domains:
        ObjectName|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings
    filter_main_dword:
        NewValue|startswith: DWORD
    filter_main_null:
        NewValue: null
    filter_main_office:
        NewValue:
            - 'Cookie:'
            - 'Visited:'
            - (Empty)
    filter_main_path:
        ObjectName|contains:
            - \Cache
            - \ZoneMap
            - \WpadDecision
    filter_main_binary:
        NewValue: Binary Data
    filter_optional_accepted_documents:
        # Spotted during Office installations
        ObjectName|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents
    condition: registry_set and (selection_domains and not 1 of filter_main_* and not 1 of filter_optional_*)
falsepositives:
    - Unknown
level: low
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

dae71b8b-77f9-4ae6-b9b6-935940db6d68

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion