Detection rules › Sigma

IE Change Domain Zone

Severity
medium
Author
frack113
Source
upstream

Hides the file extension through modification of the registry

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1137 Office Application Startup

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: selection_domains

TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\'

Stage 2: not filter

Details: ['(Empty)', 'DWORD (0x00000000)', 'DWORD (0x00000001)']

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailseq
  • (Empty) corpus 24 (sigma 24)
  • DWORD (0x00000000) corpus 38 (sigma 38)
  • DWORD (0x00000001) corpus 37 (sigma 37)
TargetObjectmatch
  • \SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\