Windows Process Creation: IE ZoneMap ProtocolDefaults downgraded to My Computer for HTTP/HTTPS
Flags Windows command lines that set IE ZoneMap ProtocolDefaults for HTTP to the My Computer (zone 0) trust level.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-09-05
- Updated
- 2026-07-30
What it detects
This rule identifies command-line activity that modifies Internet Explorer zone mapping by targeting the ZoneMap ProtocolDefaults registry path and the HTTP protocol value. It matches parameters indicating the protocol is being set to zone identifier 0, which corresponds to the My Computer trust zone. Attackers can use this to reduce the distinction between internet-sourced and local content by making downloads inherit a higher trust level. The detection relies on process creation telemetry and command line arguments containing the specified ZoneMap path and HTTP-related values.
Reporting behind it
- twitter.comhttps://twitter.com/M_haggis/status/1699056847154725107
- twitter.comhttps://twitter.com/JAMESWT_MHT/status/1699042827261391247
- learn.microsoft.comhttps://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
- virustotal.comhttps://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: IE ZoneMap ProtocolDefaults downgraded to My Computer for HTTP/HTTPS"
id: 0d8fd2f1-96d4-4967-ae37-dabc688ca558
related:
- id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724
type: similar
- id: 10344bb3-7f65-46c2-b915-2d00d47be5b0
type: derived
status: test
description: This rule identifies command-line activity that modifies Internet Explorer zone mapping by targeting the ZoneMap ProtocolDefaults registry path and the HTTP protocol value. It matches parameters indicating the protocol is being set to zone identifier 0, which corresponds to the My Computer trust zone. Attackers can use this to reduce the distinction between internet-sourced and local content by making downloads inherit a higher trust level. The detection relies on process creation telemetry and command line arguments containing the specified ZoneMap path and HTTP-related values.
references:
- https://twitter.com/M_haggis/status/1699056847154725107
- https://twitter.com/JAMESWT_MHT/status/1699042827261391247
- https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
- https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-05
tags:
- attack.execution
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- \Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
- http
- " 0"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1