Windows Process Creation: IE Security Registry Values Disabled via Command Line

title: "Windows Process Creation: IE Security Registry Values Disabled via Command Line"
id: 690e0977-47d8-42a3-9e9a-0c005dfd2c17
status: test
description: This rule flags Windows process creation events where the command line includes registry value modifications intended to disable Internet Explorer security hardening settings. Attackers may use these changes to weaken browser protections and reduce barriers to malicious content or follow-on activity. Detection relies on process command-line telemetry containing specific registry parameter names and expected value data.
references:
  - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_disable_ie_features.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-06-19
modified: 2021-11-27
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains|all:
      - " -name IEHarden "
      - " -value 0 "
  selection2:
    CommandLine|contains|all:
      - " -name DEPOff "
      - " -value 1 "
  selection3:
    CommandLine|contains|all:
      - " -name DisableFirstRunCustomize "
      - " -value 2 "
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fb50eb7a-5ab1-43ae-bcc9-091818cb8424
    type: derived