HTTP_HTTPS Default Security Zone Modified to Local Machine (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Threat actors may Windows Registry to reconfigure the default Internet Zone settings for both HTTP and HTTPS, aligning them with the "My Computer" zone. The effectively grants websites the same level of trust as files and applications locally stored on your machine. This use case detects modifications to Windows registry settings to elevate trust levels for websites, treating them similarly to locally stored files.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

References

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '29278.52976'
title: HTTP_HTTPS Default Security Zone Modified to Local Machine
description: Threat actors may Windows Registry to reconfigure the default Internet
  Zone settings for both HTTP and HTTPS, aligning them with the "My Computer" zone.
  The effectively grants websites the same level of trust as files and applications
  locally stored on your machine. This use case detects modifications to Windows registry
  settings to elevate trust levels for websites, treating them similarly to locally
  stored files.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults"
  (" http " OR " https ") (" /d " OR "-Value" OR "0x00000000") | regex process="(?i)HKCU|HKEY_CURRENT_USER|HKLM|HKEY_LOCAL_MACHINE|HKU"
  | regex process="(?i)\/d\s+0|\-Value\s+0|0x00000000" | table _time, host, user,
  process, process_name, parent_process_name | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- PowerShell logs
references:
- https://twitter.com/JAMESWT_MHT/status/1699042827261391247
- https://attack.mitre.org/techniques/T1112/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR "<EventID>4104<") "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults" (" http " OR " https ") (" /d " OR "-Value" OR "0x00000000")

Stage 2: `regex`

| regex process="(?i)HKCU|HKEY_CURRENT_USER|HKLM|HKEY_LOCAL_MACHINE|HKU"

Stage 3: `regex`

| regex process="(?i)\/d\s+0|\-Value\s+0|0x00000000"

Stage 4: `table`

| table _time, host, user, process, process_name, parent_process_name

Stage 5: `bucket`

| bin span=1s

Stage 6: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`
`process`	regex_match	`"(?i)HKCU` `HKEY_CURRENT_USER` `HKLM` `HKEY_LOCAL_MACHINE` `HKU"` corpus 2 (splunk 2) `"(?i)\/d\s+0` `\-Value\s+0` `0x00000000"` corpus 2 (splunk 2)	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4104<"`
1	`"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults"`
1	`" http "`
1	`" https "`
1	`" /d "`
1	`"-Value"`
1	`"0x00000000"`