{"id":"d88d0ab2-e696-4d40-a2ed-9790064e66b3","title":"Modification of IE Registry Settings","description":"Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence","author":"frack113","status":"test","level":"low","date":"2022-01-22","modified":"2025-10-22","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry"],"source_path":"rules/windows/registry/registry_set/registry_set_persistence_ie.yml","source_sha256":"129fa12dff840443e02a4aa48a2ca52c21c2ddaacb0179925014f4d12dd77e3e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_ie.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Modification of IE Registry Settings\nid: d88d0ab2-e696-4d40-a2ed-9790064e66b3\nstatus: test\ndescription: Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry\nauthor: frack113\ndate: 2022-01-22\nmodified: 2025-10-22\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_domains:\n        TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings'\n    filter_main_dword:\n        Details|startswith: 'DWORD'\n    filter_main_null:\n        Details: null\n    filter_main_office:\n        Details:\n            - 'Cookie:'\n            - 'Visited:'\n            - '(Empty)'\n    filter_main_path:\n        TargetObject|contains:\n            - '\\Cache'\n            - '\\ZoneMap'\n            - '\\WpadDecision'\n    filter_main_binary:\n        Details: 'Binary Data'\n    filter_optional_accepted_documents:\n        # Spotted during Office installations\n        TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Accepted Documents'\n    condition: selection_domains and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/d88d0ab2-e696-4d40-a2ed-9790064e66b3.json","kind":"sigma"}