Windows Registry: Internet Explorer DisableFirstRunCustomize Set via Explorer or ie4uinit

Alerts on Windows registry writes to Internet Explorer DisableFirstRunCustomize that change first-run wizard customization states.

FreeUnreviewedSigmamediumv1

windows-registry-internet-explorer-disablefirstruncustomize-set-via-explorer-or--ab567429

title: "Windows Registry: Internet Explorer DisableFirstRunCustomize Set via Explorer or ie4uinit"
id: b6e23738-e85b-4ad2-a42e-10bc3cf54ab0
status: test
description: This rule flags registry modifications to the Internet Explorer policy/user value DisableFirstRunCustomize with DWORD data indicating first-run customization states. Disabling or altering the first-run experience can help an attacker reduce user awareness or interfere with normal browser initialization following installation or updates. It relies on Windows registry set telemetry matching writes to the specific DisableFirstRunCustomize value, while excluding common benign activity patterns based on process image and known optional software temp paths.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
  - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
  - https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-16
modified: 2025-10-07
tags:
  - attack.defense-impairment
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: \Microsoft\Internet Explorer\Main\DisableFirstRunCustomize
    Details:
      - DWORD (0x00000001)
      - DWORD (0x00000002)
  filter_main_generic:
    Image:
      - C:\Windows\explorer.exe
      - C:\Windows\System32\ie4uinit.exe
  filter_optional_avira:
    Image|contains|all:
      - \Temp\
      - \.cr\avira_
    Details|contains: DWORD (0x00000001)
  filter_optional_foxit:
    Image:
      - C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe
      - C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe
    Details|contains: DWORD (0x00000001)
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - As this is controlled by group policy as well as user settings. Some false positives may occur.
level: medium
license: DRL-1.1
related:
  - id: ab567429-1dfb-4674-b6d2-979fd2f9d125
    type: derived

What it detects

This rule flags registry modifications to the Internet Explorer policy/user value DisableFirstRunCustomize with DWORD data indicating first-run customization states. Disabling or altering the first-run experience can help an attacker reduce user awareness or interfere with normal browser initialization following installation or updates. It relies on Windows registry set telemetry matching writes to the specific DisableFirstRunCustomize value, while excluding common benign activity patterns based on process image and known optional software temp paths.

Known false positives

As this is controlled by group policy as well as user settings. Some false positives may occur.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.