Detection rules › Splunk
HTTP_HTTPS Default Security Zone Modified to Local Machine (PowerShell)
Threat actors may Windows Registry to reconfigure the default Internet Zone settings for both HTTP and HTTPS, aligning them with the "My Computer" zone. The effectively grants websites the same level of trust as files and applications locally stored on your machine. This use case detects modifications to Windows registry settings to elevate trust levels for websites, treating them similarly to locally stored files.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1112 Modify Registry |
| Defense Impairment | T1112 Modify Registry |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
id: '29278.52976'
title: HTTP_HTTPS Default Security Zone Modified to Local Machine
description: Threat actors may Windows Registry to reconfigure the default Internet
Zone settings for both HTTP and HTTPS, aligning them with the "My Computer" zone.
The effectively grants websites the same level of trust as files and applications
locally stored on your machine. This use case detects modifications to Windows registry
settings to elevate trust levels for websites, treating them similarly to locally
stored files.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
"<EventID>4104<") "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults"
(" http " OR " https ") (" /d " OR "-Value" OR "0x00000000") | regex process="(?i)HKCU|HKEY_CURRENT_USER|HKLM|HKEY_LOCAL_MACHINE|HKU"
| regex process="(?i)\/d\s+0|\-Value\s+0|0x00000000" | table _time, host, user,
process, process_name, parent_process_name | bin span=1s | stats values(*) as *
by _time, host '
techniques:
- defense-evasion:modify registry
technique_id:
- T1112
data_category:
- PowerShell logs
references:
- https://twitter.com/JAMESWT_MHT/status/1699042827261391247
- https://attack.mitre.org/techniques/T1112/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR "<EventID>4104<") "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults" (" http " OR " https ") (" /d " OR "-Value" OR "0x00000000")
Stage 2: regex
| regex process="(?i)HKCU|HKEY_CURRENT_USER|HKLM|HKEY_LOCAL_MACHINE|HKU"
Stage 3: regex
| regex process="(?i)\/d\s+0|\-Value\s+0|0x00000000"
Stage 4: table
| table _time, host, user, process, process_name, parent_process_name
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4104<" |
| 1 | "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults" |
| 1 | " http " |
| 1 | " https " |
| 1 | " /d " |
| 1 | "-Value" |
| 1 | "0x00000000" |