Windows Registry Modification via Process Creation Command Lines Indicative of Ke3chang/TidePool
Alerts on Windows process command lines that set IE hardening and related Internet Explorer registry properties consistent with Ke3chang/TidePool.
- Product
- windows
- Category
- process_creation
- Author
- Markus Neis, Swisscom (SigmaHQ), DRL 1.1
- Published
- 2020-06-18
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions whose command lines include specific Internet Explorer hardening and first-run customization registry property settings associated with Ke3chang/TidePool. Such modifications can weaken browser and security-related configuration, supporting defense-impairment and stealthy persistence. It relies on process creation telemetry that captures the full command line used to set the registry values.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20200618080300/https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Ke3chang-TidePool/proc_creation_win_malware_ke3chang_tidepool.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Modification via Process Creation Command Lines Indicative of Ke3chang/TidePool
id: 037d2ee1-8e3b-458c-944f-41698e57660d
status: test
description: This rule flags Windows process executions whose command lines include specific Internet Explorer hardening and first-run customization registry property settings associated with Ke3chang/TidePool. Such modifications can weaken browser and security-related configuration, supporting defense-impairment and stealthy persistence. It relies on process creation telemetry that captures the full command line used to set the registry values.
references:
- https://web.archive.org/web/20200618080300/https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf
- https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Ke3chang-TidePool/proc_creation_win_malware_ke3chang_tidepool.yml
author: Markus Neis, Swisscom, Huntrule Team
date: 2020-06-18
modified: 2023-03-10
tags:
- attack.defense-impairment
- attack.g0004
- attack.t1685
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- -Property DWORD -name DisableFirstRunCustomize -value 2 -Force
- -Property String -name Check_Associations -value
- -Property DWORD -name IEHarden -value 0 -Force
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7b544661-69fc-419f-9a59-82ccc328f205
type: derived