Windows Registry Hardening Changes via Process Command-Line Indicative of Ke3chang/TidePool

title: Windows Registry Hardening Changes via Process Command-Line Indicative of Ke3chang/TidePool
id: 037d2ee1-8e3b-458c-944f-41698e57660d
status: test
description: This rule flags Windows process creation events where the command line contains specific registry modification arguments related to Internet Explorer hardening and first-run/association settings. Such changes matter because malware can weaken or alter browser security controls to enable persistence, deception, or follow-on activity. The detection relies on process creation telemetry with command-line content matching the configured registry property parameters.
references:
  - https://web.archive.org/web/20200618080300/https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf
  - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Ke3chang-TidePool/proc_creation_win_malware_ke3chang_tidepool.yml
author: Markus Neis, Swisscom, Huntrule Team
date: 2020-06-18
modified: 2023-03-10
tags:
  - attack.defense-impairment
  - attack.g0004
  - attack.t1685
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - -Property DWORD -name DisableFirstRunCustomize -value 2 -Force
      - -Property String -name Check_Associations -value
      - -Property DWORD -name IEHarden -value 0 -Force
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7b544661-69fc-419f-9a59-82ccc328f205
    type: derived