Network proxy configuration changed

Status: experimental
Severity: medium
Log source: product windows, service proxy_configuration
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to modify proxy configuration in order to bypass network restrictions.

Known false positives

admin proxy debugging
new proxy configuration applied

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1090` Proxy
Command and Control	`T0884` Connection Proxy

Telemetry coverage

Provider	Record / event type
WinINet-Config	Event ID 5600: task_0

Rule body

title: Network proxy configuration changed
description: Detects scenarios where an attacker attempts to modify proxy configuration in order to bypass network restrictions.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack
tags:
- attack.command_and_control
- attack.t1090 # proxy
- attack.t0884 # connection proxy
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: proxy_configuration
detection:
  selection_baseline:
    Channel: Microsoft-Windows-WinINet-Config/ProxyConfigChanged
    EventID: 5600
  selection_proxy:
    - pwszAutoConfigUrl|startswith: http
    - pwszProxy|startswith: http
    - pwszProxyBypass|startswith: http
  filter:
    - pwszAutoConfigUrl: #<http://your_company_url_proxy.lan>
    - pwszProxy: #<http://your_company_url_proxy.lan>
  condition: selection_baseline and selection_proxy and not filter
falsepositives:
- admin proxy debugging
- new proxy configuration applied 
level: medium

Stages and Predicates

Stage 0: `condition`

selection_baseline and selection_proxy and not filter

Stage 1: `selection_baseline`

selection_baseline:
  Channel: Microsoft-Windows-WinINet-Config/ProxyConfigChanged
  EventID: 5600

Stage 2: `selection_proxy`

selection_proxy:
  - pwszAutoConfigUrl|startswith: http
  - pwszProxy|startswith: http
  - pwszProxyBypass|startswith: http

Stage 3: `not filter`

filter:
  - pwszAutoConfigUrl:
  - pwszProxy:

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`pwszAutoConfigUrl`	is_null	(no value, null check)	`excludes:pwszAutoConfigUrl`
`pwszProxy`	is_null	(no value, null check)	`excludes:pwszProxy`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`pwszAutoConfigUrl`	starts_with	`http`	`field:"pwszAutoConfigUrl" kind:starts_with value:"http"`
`pwszProxy`	starts_with	`http`	`field:"pwszProxy" kind:starts_with value:"http"`
`pwszProxyBypass`	starts_with	`http`	`field:"pwszProxyBypass" kind:starts_with value:"http"`