Internet Explorer DisableFirstRunCustomize Enabled

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

Known false positives

As this is controlled by group policy as well as user settings. Some false positives may occur.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Internet Explorer DisableFirstRunCustomize Enabled
id: ab567429-1dfb-4674-b6d2-979fd2f9d125
status: test
description: |
    Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
    - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
    - https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-16
modified: 2025-10-07
tags:
    - attack.defense-impairment
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|endswith: '\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize'
        Details:
            - 'DWORD (0x00000001)' # Home Page
            - 'DWORD (0x00000002)' # Welcome To IE
    filter_main_generic:
        Image:
            - 'C:\Windows\explorer.exe'
            - 'C:\Windows\System32\ie4uinit.exe'
    filter_optional_avira:
        Image|contains|all:
            - '\Temp\'
            - '\.cr\avira_'
        Details|contains: 'DWORD (0x00000001)'
    filter_optional_foxit:
        Image:
            - 'C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe'
            - 'C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe'
        Details|contains: 'DWORD (0x00000001)'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - As this is controlled by group policy as well as user settings. Some false positives may occur.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    TargetObject|endswith: '\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize'
    Details:
        - 'DWORD (0x00000001)'
        - 'DWORD (0x00000002)'

Stage 2: `not filter_main_generic`

filter_main_generic:
    Image:
        - 'C:\Windows\explorer.exe'
        - 'C:\Windows\System32\ie4uinit.exe'

Stage 3: `not filter_optional_*`

filter_optional_avira:
    Image|contains|all:
        - '\Temp\'
        - '\.cr\avira_'
    Details|contains: 'DWORD (0x00000001)'
filter_optional_foxit:
    Image:
        - 'C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe'
        - 'C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe'
    Details|contains: 'DWORD (0x00000001)'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`C:\Windows\System32\ie4uinit.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\ie4uinit.exe"`
`Image`	eq	`C:\Windows\explorer.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\explorer.exe"`
`Image`	eq	`C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe"`
`Image`	eq	`C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe`	`excludes:Image` `field:"Image" value:"C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe"`
`Details`	match	`DWORD (0x00000001)`	`excludes:Details` `field:"Details" value:"DWORD (0x00000001)"`
`Image`	match	`\.cr\avira_`	`excludes:Image` `field:"Image" value:"\.cr\avira_"`
`Image`	match	`\Temp\`	`excludes:Image` `field:"Image" value:"\Temp\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	eq	`DWORD (0x00000001)` corpus 40 (sigma 36, chronicle 4) `DWORD (0x00000002)` corpus 10 (sigma 9, chronicle 1)	`field:"Details" kind:eq`
`TargetObject`	ends_with	`\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize`	`field:"TargetObject" kind:ends_with value:"\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize"`