Internet Explorer DisableFirstRunCustomize Enabled

Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `selection`

Details: ['DWORD (0x00000001)', 'DWORD (0x00000002)']
TargetObject|endswith: '\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize'

Stage 2: `not 1 of filter_main_generic`

Image: ['C:\Windows\System32\ie4uinit.exe', 'C:\Windows\explorer.exe']

Stage 3: `not 1 of filter_optional_*`

or:
Image: ['C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe', 'C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe']
Details|contains: 'DWORD (0x00000001)'
Details|contains: 'DWORD (0x00000001)'
Image|contains: '\.cr\avira_'
Image|contains: '\Temp\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Details`	eq	`DWORD (0x00000001)` corpus 37 (sigma 37) `DWORD (0x00000002)` corpus 9 (sigma 9)
`Details`	match	`DWORD (0x00000001)`
`Image`	eq	`C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe` `C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe` `C:\Windows\System32\ie4uinit.exe` `C:\Windows\explorer.exe` corpus 9 (sigma 9)
`Image`	match	`\.cr\avira_` `\Temp\` corpus 5 (sigma 5)
`TargetObject`	ends_with	`\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize`