Windows Process Creation: IE ZoneMap ProtocolDefaults downgraded to My Computer for HTTP/HTTPS

title: "Windows Process Creation: IE ZoneMap ProtocolDefaults downgraded to My Computer for HTTP/HTTPS"
id: 0d8fd2f1-96d4-4967-ae37-dabc688ca558
related:
  - id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724
    type: similar
  - id: 10344bb3-7f65-46c2-b915-2d00d47be5b0
    type: derived
status: test
description: This rule identifies command-line activity that modifies Internet Explorer zone mapping by targeting the ZoneMap ProtocolDefaults registry path and the HTTP protocol value. It matches parameters indicating the protocol is being set to zone identifier 0, which corresponds to the My Computer trust zone. Attackers can use this to reduce the distinction between internet-sourced and local content by making downloads inherit a higher trust level. The detection relies on process creation telemetry and command line arguments containing the specified ZoneMap path and HTTP-related values.
references:
  - https://twitter.com/M_haggis/status/1699056847154725107
  - https://twitter.com/JAMESWT_MHT/status/1699042827261391247
  - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
  - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-05
tags:
  - attack.execution
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - \Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
      - http
      - " 0"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1