Windows Registry ZoneMap ProtocolDefaults Downgraded to My Computer for HTTP/HTTPS
Flags IE/Windows ZoneMap changes setting HTTP/HTTPS ProtocolDefaults DWORD 0x00000000 to the My Computer zone.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea) (SigmaHQ), DRL 1.1
- Published
- 2023-09-05
- Updated
- 2026-07-30
What it detects
This rule identifies registry changes to Internet Explorer/Windows Internet zone mappings where ZoneMap ProtocolDefaults for the HTTP and HTTPS protocol keys are set to DWORD value 0x00000000. Redirecting protocol handling to the My Computer zone can increase the trust level assigned to content retrieved over those protocols, enabling less-restricted behavior for downloaded files. Telemetry relies on Windows registry_set events capturing modifications to TargetObject paths under the IE ZoneMap ProtocolDefaults keys and the presence of the expected DWORD content.
Reporting behind it
- twitter.comhttps://twitter.com/M_haggis/status/1699056847154725107
- twitter.comhttps://twitter.com/JAMESWT_MHT/status/1699042827261391247
- learn.microsoft.comhttps://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
- virustotal.comhttps://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry ZoneMap ProtocolDefaults Downgraded to My Computer for HTTP/HTTPS
id: 9587c5fe-49b1-4ac9-abc9-e5e36cd5d37d
related:
- id: 10344bb3-7f65-46c2-b915-2d00d47be5b0
type: similar
- id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724
type: derived
status: test
description: This rule identifies registry changes to Internet Explorer/Windows Internet zone mappings where ZoneMap ProtocolDefaults for the HTTP and HTTPS protocol keys are set to DWORD value 0x00000000. Redirecting protocol handling to the My Computer zone can increase the trust level assigned to content retrieved over those protocols, enabling less-restricted behavior for downloaded files. Telemetry relies on Windows registry_set events capturing modifications to TargetObject paths under the IE ZoneMap ProtocolDefaults keys and the presence of the expected DWORD content.
references:
- https://twitter.com/M_haggis/status/1699056847154725107
- https://twitter.com/JAMESWT_MHT/status/1699042827261391247
- https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
- https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml
author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea), Huntrule Team
date: 2023-09-05
tags:
- attack.stealth
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|contains: \Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
TargetObject|endswith:
- \http
- \https
Details|contains: DWORD (0x00000000)
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1