Windows Registry: Internet Settings Zone and Cache-related Key Modifications

title: "Windows Registry: Internet Settings Zone and Cache-related Key Modifications"
id: 0b2d2c62-a933-4814-afc9-5f543bba343b
status: test
description: This rule identifies registry modifications to Internet Settings paths under HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings, including subpaths associated with zones, cache, and related decision keys. Attackers can use these settings to influence trusted site handling or store script data for persistence and defense evasion. Detection relies on registry event telemetry containing TargetObject and Details fields, with exclusions for common non-DWORD/Office-related value patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_ie.yml
author: frack113, Huntrule Team
date: 2022-01-22
modified: 2025-10-22
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection_domains:
    TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings
  filter_main_dword:
    Details|startswith: DWORD
  filter_main_null:
    Details: null
  filter_main_office:
    Details:
      - "Cookie:"
      - "Visited:"
      - (Empty)
  filter_main_path:
    TargetObject|contains:
      - \Cache
      - \ZoneMap
      - \WpadDecision
  filter_main_binary:
    Details: Binary Data
  filter_optional_accepted_documents:
    TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents
  condition: selection_domains and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d88d0ab2-e696-4d40-a2ed-9790064e66b3
    type: derived