Windows Registry: Attachment Manager policy tampering via Attachments settings values

title: "Windows Registry: Attachment Manager policy tampering via Attachments settings values"
id: 036a7557-2472-4f82-9a08-6294285d1d2c
status: test
description: This rule flags modifications to Microsoft Windows Attachment Manager policy settings stored under the Attachments registry path. Attackers may tamper with these controls to affect how downloaded files are treated, potentially weakening user safety prompts and security scanning behavior. It relies on registry set telemetry by matching the target registry keys and specific DWORD values indicating HideZoneInfoOnProperties, SaveZoneInformation, and ScanWithAntiVirus state changes.
references:
  - https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
  - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_policies_attachments_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-01
modified: 2023-08-17
tags:
  - attack.defense-impairment
logsource:
  category: registry_set
  product: windows
detection:
  selection_main:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\
  selection_value_hide_zone_info:
    TargetObject|endswith: \HideZoneInfoOnProperties
    Details: DWORD (0x00000001)
  selection_value_save_zone_info:
    TargetObject|endswith: \SaveZoneInformation
    Details: DWORD (0x00000002)
  selection_value_scan_with_av:
    TargetObject|endswith: \ScanWithAntiVirus
    Details: DWORD (0x00000001)
  condition: selection_main and 1 of selection_value_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a
    type: derived