Windows Registry ZoneMap ProtocolDefaults Downgraded to My Computer for HTTP/HTTPS

title: Windows Registry ZoneMap ProtocolDefaults Downgraded to My Computer for HTTP/HTTPS
id: 9587c5fe-49b1-4ac9-abc9-e5e36cd5d37d
related:
  - id: 10344bb3-7f65-46c2-b915-2d00d47be5b0
    type: similar
  - id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724
    type: derived
status: test
description: This rule identifies registry changes to Internet Explorer/Windows Internet zone mappings where ZoneMap ProtocolDefaults for the HTTP and HTTPS protocol keys are set to DWORD value 0x00000000. Redirecting protocol handling to the My Computer zone can increase the trust level assigned to content retrieved over those protocols, enabling less-restricted behavior for downloaded files. Telemetry relies on Windows registry_set events capturing modifications to TargetObject paths under the IE ZoneMap ProtocolDefaults keys and the presence of the expected DWORD content.
references:
  - https://twitter.com/M_haggis/status/1699056847154725107
  - https://twitter.com/JAMESWT_MHT/status/1699042827261391247
  - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
  - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml
author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea), Huntrule Team
date: 2023-09-05
tags:
  - attack.stealth
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
    TargetObject|endswith:
      - \http
      - \https
    Details|contains: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1