Windows Registry: Internet Settings Zone and Cache-related Key Modifications
Flags registry writes to Windows Internet Settings-related keys that can be abused to alter zone trust or store persistence data.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-22
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry modifications to Internet Settings paths under HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings, including subpaths associated with zones, cache, and related decision keys. Attackers can use these settings to influence trusted site handling or store script data for persistence and defense evasion. Detection relies on registry event telemetry containing TargetObject and Details fields, with exclusions for common non-DWORD/Office-related value patterns.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_ie.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Internet Settings Zone and Cache-related Key Modifications"
id: 0b2d2c62-a933-4814-afc9-5f543bba343b
status: test
description: This rule identifies registry modifications to Internet Settings paths under HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings, including subpaths associated with zones, cache, and related decision keys. Attackers can use these settings to influence trusted site handling or store script data for persistence and defense evasion. Detection relies on registry event telemetry containing TargetObject and Details fields, with exclusions for common non-DWORD/Office-related value patterns.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_ie.yml
author: frack113, Huntrule Team
date: 2022-01-22
modified: 2025-10-22
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
category: registry_set
product: windows
detection:
selection_domains:
TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings
filter_main_dword:
Details|startswith: DWORD
filter_main_null:
Details: null
filter_main_office:
Details:
- "Cookie:"
- "Visited:"
- (Empty)
filter_main_path:
TargetObject|contains:
- \Cache
- \ZoneMap
- \WpadDecision
filter_main_binary:
Details: Binary Data
filter_optional_accepted_documents:
TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents
condition: selection_domains and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: d88d0ab2-e696-4d40-a2ed-9790064e66b3
type: derived