IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols

Status: test
Severity: high
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea)
Source: github.com/SigmaHQ/sigma

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols
id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724
related:
    - id: 10344bb3-7f65-46c2-b915-2d00d47be5b0
      type: similar
status: test
description: |
    Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
references:
    - https://twitter.com/M_haggis/status/1699056847154725107
    - https://twitter.com/JAMESWT_MHT/status/1699042827261391247
    - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
    - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea)
date: 2023-09-05
tags:
    - attack.stealth
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults'
        TargetObject|endswith:
            - '\http'
            - '\https'
        Details|contains: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults'
    TargetObject|endswith:
        - '\http'
        - '\https'
    Details|contains: 'DWORD (0x00000000)'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	match	`DWORD (0x00000000)` corpus 2 (sigma 2)	`field:"Details" kind:match value:"DWORD (0x00000000)"`
`TargetObject`	ends_with	`\http` `\https`	`field:"TargetObject" kind:ends_with`
`TargetObject`	match	`\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults`	`field:"TargetObject" kind:match value:"\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults"`