Windows Registry: Attachment Manager policy tampering via Attachments settings values
Detects registry changes to Windows Attachment Manager policy values that can disable or alter download safety controls.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-01
- Updated
- 2026-07-30
What it detects
This rule flags modifications to Microsoft Windows Attachment Manager policy settings stored under the Attachments registry path. Attackers may tamper with these controls to affect how downloaded files are treated, potentially weakening user safety prompts and security scanning behavior. It relies on registry set telemetry by matching the target registry keys and specific DWORD values indicating HideZoneInfoOnProperties, SaveZoneInformation, and ScanWithAntiVirus state changes.
Reporting behind it
- support.microsoft.comhttps://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
- virustotal.comhttps://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_policies_attachments_tamper.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Attachment Manager policy tampering via Attachments settings values"
id: 036a7557-2472-4f82-9a08-6294285d1d2c
status: test
description: This rule flags modifications to Microsoft Windows Attachment Manager policy settings stored under the Attachments registry path. Attackers may tamper with these controls to affect how downloaded files are treated, potentially weakening user safety prompts and security scanning behavior. It relies on registry set telemetry by matching the target registry keys and specific DWORD values indicating HideZoneInfoOnProperties, SaveZoneInformation, and ScanWithAntiVirus state changes.
references:
- https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
- https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_policies_attachments_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-01
modified: 2023-08-17
tags:
- attack.defense-impairment
logsource:
category: registry_set
product: windows
detection:
selection_main:
TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\
selection_value_hide_zone_info:
TargetObject|endswith: \HideZoneInfoOnProperties
Details: DWORD (0x00000001)
selection_value_save_zone_info:
TargetObject|endswith: \SaveZoneInformation
Details: DWORD (0x00000002)
selection_value_scan_with_av:
TargetObject|endswith: \ScanWithAntiVirus
Details: DWORD (0x00000001)
condition: selection_main and 1 of selection_value_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a
type: derived